Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2009-0159 (GCVE-0-2009-0159)
Vulnerability from cvelistv5
Published
2009-04-14 15:00
Modified
2024-08-07 04:24
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Stack-based buffer overflow in the cookedprint function in ntpq/ntpq.c in ntpq in NTP before 4.2.4p7-RC2 allows remote NTP servers to execute arbitrary code via a crafted response.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T04:24:18.219Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "USN-777-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "https://usn.ubuntu.com/777-1/"
},
{
"name": "oval:org.mitre.oval:def:9634",
"tags": [
"vdb-entry",
"signature",
"x_refsource_OVAL",
"x_transferred"
],
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9634"
},
{
"name": "35137",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/35137"
},
{
"name": "34608",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/34608"
},
{
"name": "35166",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/35166"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=490617"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://support.apple.com/kb/HT3549"
},
{
"name": "37471",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/37471"
},
{
"name": "DSA-1801",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2009/dsa-1801"
},
{
"name": "FEDORA-2009-5275",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01449.html"
},
{
"name": "35308",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/35308"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://bugs.pardus.org.tr/show_bug.cgi?id=9532"
},
{
"name": "35253",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/35253"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.vmware.com/security/advisories/VMSA-2009-0016.html"
},
{
"name": "35074",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/35074"
},
{
"name": "34481",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/34481"
},
{
"name": "35138",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/35138"
},
{
"name": "APPLE-SA-2009-05-12",
"tags": [
"vendor-advisory",
"x_refsource_APPLE",
"x_transferred"
],
"url": "http://lists.apple.com/archives/security-announce/2009/May/msg00002.html"
},
{
"name": "oval:org.mitre.oval:def:8386",
"tags": [
"vdb-entry",
"signature",
"x_refsource_OVAL",
"x_transferred"
],
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8386"
},
{
"name": "SSA:2009-154-01",
"tags": [
"vendor-advisory",
"x_refsource_SLACKWARE",
"x_transferred"
],
"url": "http://slackware.com/security/viewer.php?l=slackware-security\u0026y=2009\u0026m=slackware-security.566238"
},
{
"name": "SSRT101144",
"tags": [
"vendor-advisory",
"x_refsource_HP",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=136482797910018\u0026w=2"
},
{
"name": "FEDORA-2009-5273",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01414.html"
},
{
"name": "SUSE-SR:2009:011",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html"
},
{
"name": "oval:org.mitre.oval:def:19392",
"tags": [
"vdb-entry",
"signature",
"x_refsource_OVAL",
"x_transferred"
],
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19392"
},
{
"name": "35630",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/35630"
},
{
"name": "20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/507985/100/0/threaded"
},
{
"name": "ntp-cookedprint-bo(49838)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/49838"
},
{
"name": "53593",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/53593"
},
{
"name": "1022033",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id?1022033"
},
{
"name": "oval:org.mitre.oval:def:8665",
"tags": [
"vdb-entry",
"signature",
"x_refsource_OVAL",
"x_transferred"
],
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8665"
},
{
"name": "TA09-133A",
"tags": [
"third-party-advisory",
"x_refsource_CERT",
"x_transferred"
],
"url": "http://www.us-cert.gov/cas/techalerts/TA09-133A.html"
},
{
"name": "RHSA-2009:1651",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://rhn.redhat.com/errata/RHSA-2009-1651.html"
},
{
"name": "ADV-2009-1297",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2009/1297"
},
{
"name": "oval:org.mitre.oval:def:5411",
"tags": [
"vdb-entry",
"signature",
"x_refsource_OVAL",
"x_transferred"
],
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5411"
},
{
"name": "RHSA-2009:1040",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2009-1040.html"
},
{
"name": "MDVSA-2009:092",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:092"
},
{
"name": "35416",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/35416"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://support.ntp.org/bugs/show_bug.cgi?id=1144"
},
{
"name": "HPSBUX02859",
"tags": [
"vendor-advisory",
"x_refsource_HP",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=136482797910018\u0026w=2"
},
{
"name": "35336",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/35336"
},
{
"name": "NetBSD-SA2009-006",
"tags": [
"vendor-advisory",
"x_refsource_NETBSD",
"x_transferred"
],
"url": "ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-006.txt.asc"
},
{
"name": "RHSA-2009:1039",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2009-1039.html"
},
{
"name": "35169",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/35169"
},
{
"name": "GLSA-200905-08",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "http://www.gentoo.org/security/en/glsa/glsa-200905-08.xml"
},
{
"name": "ADV-2009-0999",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2009/0999"
},
{
"name": "ADV-2009-3316",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2009/3316"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://ntp.bkbits.net:8080/ntp-stable/?PAGE=gnupatch\u0026REV=1.1565"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2009-04-12T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Stack-based buffer overflow in the cookedprint function in ntpq/ntpq.c in ntpq in NTP before 4.2.4p7-RC2 allows remote NTP servers to execute arbitrary code via a crafted response."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-11T19:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "USN-777-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "https://usn.ubuntu.com/777-1/"
},
{
"name": "oval:org.mitre.oval:def:9634",
"tags": [
"vdb-entry",
"signature",
"x_refsource_OVAL"
],
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9634"
},
{
"name": "35137",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/35137"
},
{
"name": "34608",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/34608"
},
{
"name": "35166",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/35166"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=490617"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://support.apple.com/kb/HT3549"
},
{
"name": "37471",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/37471"
},
{
"name": "DSA-1801",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2009/dsa-1801"
},
{
"name": "FEDORA-2009-5275",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01449.html"
},
{
"name": "35308",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/35308"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://bugs.pardus.org.tr/show_bug.cgi?id=9532"
},
{
"name": "35253",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/35253"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.vmware.com/security/advisories/VMSA-2009-0016.html"
},
{
"name": "35074",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/35074"
},
{
"name": "34481",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/34481"
},
{
"name": "35138",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/35138"
},
{
"name": "APPLE-SA-2009-05-12",
"tags": [
"vendor-advisory",
"x_refsource_APPLE"
],
"url": "http://lists.apple.com/archives/security-announce/2009/May/msg00002.html"
},
{
"name": "oval:org.mitre.oval:def:8386",
"tags": [
"vdb-entry",
"signature",
"x_refsource_OVAL"
],
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8386"
},
{
"name": "SSA:2009-154-01",
"tags": [
"vendor-advisory",
"x_refsource_SLACKWARE"
],
"url": "http://slackware.com/security/viewer.php?l=slackware-security\u0026y=2009\u0026m=slackware-security.566238"
},
{
"name": "SSRT101144",
"tags": [
"vendor-advisory",
"x_refsource_HP"
],
"url": "http://marc.info/?l=bugtraq\u0026m=136482797910018\u0026w=2"
},
{
"name": "FEDORA-2009-5273",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01414.html"
},
{
"name": "SUSE-SR:2009:011",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html"
},
{
"name": "oval:org.mitre.oval:def:19392",
"tags": [
"vdb-entry",
"signature",
"x_refsource_OVAL"
],
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19392"
},
{
"name": "35630",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/35630"
},
{
"name": "20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/507985/100/0/threaded"
},
{
"name": "ntp-cookedprint-bo(49838)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/49838"
},
{
"name": "53593",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/53593"
},
{
"name": "1022033",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id?1022033"
},
{
"name": "oval:org.mitre.oval:def:8665",
"tags": [
"vdb-entry",
"signature",
"x_refsource_OVAL"
],
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8665"
},
{
"name": "TA09-133A",
"tags": [
"third-party-advisory",
"x_refsource_CERT"
],
"url": "http://www.us-cert.gov/cas/techalerts/TA09-133A.html"
},
{
"name": "RHSA-2009:1651",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://rhn.redhat.com/errata/RHSA-2009-1651.html"
},
{
"name": "ADV-2009-1297",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2009/1297"
},
{
"name": "oval:org.mitre.oval:def:5411",
"tags": [
"vdb-entry",
"signature",
"x_refsource_OVAL"
],
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5411"
},
{
"name": "RHSA-2009:1040",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2009-1040.html"
},
{
"name": "MDVSA-2009:092",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:092"
},
{
"name": "35416",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/35416"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://support.ntp.org/bugs/show_bug.cgi?id=1144"
},
{
"name": "HPSBUX02859",
"tags": [
"vendor-advisory",
"x_refsource_HP"
],
"url": "http://marc.info/?l=bugtraq\u0026m=136482797910018\u0026w=2"
},
{
"name": "35336",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/35336"
},
{
"name": "NetBSD-SA2009-006",
"tags": [
"vendor-advisory",
"x_refsource_NETBSD"
],
"url": "ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-006.txt.asc"
},
{
"name": "RHSA-2009:1039",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2009-1039.html"
},
{
"name": "35169",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/35169"
},
{
"name": "GLSA-200905-08",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "http://www.gentoo.org/security/en/glsa/glsa-200905-08.xml"
},
{
"name": "ADV-2009-0999",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2009/0999"
},
{
"name": "ADV-2009-3316",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2009/3316"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://ntp.bkbits.net:8080/ntp-stable/?PAGE=gnupatch\u0026REV=1.1565"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2009-0159",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Stack-based buffer overflow in the cookedprint function in ntpq/ntpq.c in ntpq in NTP before 4.2.4p7-RC2 allows remote NTP servers to execute arbitrary code via a crafted response."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "USN-777-1",
"refsource": "UBUNTU",
"url": "https://usn.ubuntu.com/777-1/"
},
{
"name": "oval:org.mitre.oval:def:9634",
"refsource": "OVAL",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9634"
},
{
"name": "35137",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/35137"
},
{
"name": "34608",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/34608"
},
{
"name": "35166",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/35166"
},
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=490617",
"refsource": "CONFIRM",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=490617"
},
{
"name": "http://support.apple.com/kb/HT3549",
"refsource": "CONFIRM",
"url": "http://support.apple.com/kb/HT3549"
},
{
"name": "37471",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/37471"
},
{
"name": "DSA-1801",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2009/dsa-1801"
},
{
"name": "FEDORA-2009-5275",
"refsource": "FEDORA",
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01449.html"
},
{
"name": "35308",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/35308"
},
{
"name": "http://bugs.pardus.org.tr/show_bug.cgi?id=9532",
"refsource": "CONFIRM",
"url": "http://bugs.pardus.org.tr/show_bug.cgi?id=9532"
},
{
"name": "35253",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/35253"
},
{
"name": "http://www.vmware.com/security/advisories/VMSA-2009-0016.html",
"refsource": "CONFIRM",
"url": "http://www.vmware.com/security/advisories/VMSA-2009-0016.html"
},
{
"name": "35074",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/35074"
},
{
"name": "34481",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/34481"
},
{
"name": "35138",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/35138"
},
{
"name": "APPLE-SA-2009-05-12",
"refsource": "APPLE",
"url": "http://lists.apple.com/archives/security-announce/2009/May/msg00002.html"
},
{
"name": "oval:org.mitre.oval:def:8386",
"refsource": "OVAL",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8386"
},
{
"name": "SSA:2009-154-01",
"refsource": "SLACKWARE",
"url": "http://slackware.com/security/viewer.php?l=slackware-security\u0026y=2009\u0026m=slackware-security.566238"
},
{
"name": "SSRT101144",
"refsource": "HP",
"url": "http://marc.info/?l=bugtraq\u0026m=136482797910018\u0026w=2"
},
{
"name": "FEDORA-2009-5273",
"refsource": "FEDORA",
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01414.html"
},
{
"name": "SUSE-SR:2009:011",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html"
},
{
"name": "oval:org.mitre.oval:def:19392",
"refsource": "OVAL",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19392"
},
{
"name": "35630",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/35630"
},
{
"name": "20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/507985/100/0/threaded"
},
{
"name": "ntp-cookedprint-bo(49838)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/49838"
},
{
"name": "53593",
"refsource": "OSVDB",
"url": "http://osvdb.org/53593"
},
{
"name": "1022033",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id?1022033"
},
{
"name": "oval:org.mitre.oval:def:8665",
"refsource": "OVAL",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8665"
},
{
"name": "TA09-133A",
"refsource": "CERT",
"url": "http://www.us-cert.gov/cas/techalerts/TA09-133A.html"
},
{
"name": "RHSA-2009:1651",
"refsource": "REDHAT",
"url": "https://rhn.redhat.com/errata/RHSA-2009-1651.html"
},
{
"name": "ADV-2009-1297",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2009/1297"
},
{
"name": "oval:org.mitre.oval:def:5411",
"refsource": "OVAL",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5411"
},
{
"name": "RHSA-2009:1040",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2009-1040.html"
},
{
"name": "MDVSA-2009:092",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:092"
},
{
"name": "35416",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/35416"
},
{
"name": "https://support.ntp.org/bugs/show_bug.cgi?id=1144",
"refsource": "CONFIRM",
"url": "https://support.ntp.org/bugs/show_bug.cgi?id=1144"
},
{
"name": "HPSBUX02859",
"refsource": "HP",
"url": "http://marc.info/?l=bugtraq\u0026m=136482797910018\u0026w=2"
},
{
"name": "35336",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/35336"
},
{
"name": "NetBSD-SA2009-006",
"refsource": "NETBSD",
"url": "ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-006.txt.asc"
},
{
"name": "RHSA-2009:1039",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2009-1039.html"
},
{
"name": "35169",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/35169"
},
{
"name": "GLSA-200905-08",
"refsource": "GENTOO",
"url": "http://www.gentoo.org/security/en/glsa/glsa-200905-08.xml"
},
{
"name": "ADV-2009-0999",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2009/0999"
},
{
"name": "ADV-2009-3316",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2009/3316"
},
{
"name": "http://ntp.bkbits.net:8080/ntp-stable/?PAGE=gnupatch\u0026REV=1.1565",
"refsource": "CONFIRM",
"url": "http://ntp.bkbits.net:8080/ntp-stable/?PAGE=gnupatch\u0026REV=1.1565"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2009-0159",
"datePublished": "2009-04-14T15:00:00",
"dateReserved": "2009-01-16T00:00:00",
"dateUpdated": "2024-08-07T04:24:18.219Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2009-0159\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2009-04-14T15:30:00.517\",\"lastModified\":\"2025-04-09T00:30:58.490\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Stack-based buffer overflow in the cookedprint function in ntpq/ntpq.c in ntpq in NTP before 4.2.4p7-RC2 allows remote NTP servers to execute arbitrary code via a crafted response.\"},{\"lang\":\"es\",\"value\":\"Desbordamiento de b\u00fafer basado en pila en la funci\u00f3n cookedprint en ntpq/ntpq.c en ntpq en NTP versiones anteriores a v4.2.4p7-RC2 permite a servidores NTP remotos ejecutar c\u00f3digo de su elecci\u00f3n a trav\u00e9s de respuestas manipuladas.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:P/I:P/A:P\",\"baseScore\":6.8,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":true,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-119\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:*:rc1:*:*:*:*:*:*\",\"versionEndIncluding\":\"4.2.4p7\",\"matchCriteriaId\":\"E94AD088-AEF8-4708-9EAE-1A46F7C4DC4E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.0.72:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"25AB2D70-2807-4970-ACD3-9B4751A1F9D6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.0.73:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"06C78C19-5A09-4883-8144-AE861A244FEA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.0.90:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"437C8BA8-F437-4166-838D-EDC64E7A67DC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.0.91:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"104AEC97-3C2A-48D2-BA63-08502F88F8D2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.0.92:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"87D67E30-E303-4F79-9929-4A5B587FCDB7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.0.93:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B9BD95B5-322C-4CDC-A2DB-A06D4DA3B104\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.0.94:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0BD63969-D18D-41AF-9814-DA1A207BDE80\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.0.95:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7EAD8958-173A-4FCC-9420-A148BA5F73E2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.0.96:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B271F6AD-D829-4671-8FA7-7D921364B426\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.0.97:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C25E03A8-46B5-4AC7-8506-4C255D7CC400\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.0.98:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2C76CD53-CC9F-491A-952F-9A82D6E20058\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.0.99:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E749D64E-5C47-4A34-9F3C-1D34F8348058\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EE0C9CBB-D52F-4F7C-B343-E685A3996BC6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.1.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CB90A3FB-B107-46CF-A846-48EE0EDF637A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.2.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"088BFFA4-1AAB-4699-9793-F731A81B296A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.2.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B3475779-383A-4128-9145-474EC08030FE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.2.2p1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"782BAA3D-A639-4B25-83F0-741074C88D7F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.2.2p2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EF367FA4-2C7F-4040-89DE-8A97A069A802\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.2.2p3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"01D11498-3FC4-4890-9B10-BBA74A01C9E7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.2.2p4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9D085796-5574-4EF3-8CD4-3CCEF2867823\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.2.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5E0D2303-95BD-4260-86FC-3DFED8532092\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.2.4p0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AA843BCD-372A-42F5-A8C0-1AD32FA9E94C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.2.4p1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B980A178-2958-4B36-8AD8-3932B12C5A72\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.2.4p2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5D65210A-F80E-4019-91DA-49838369E03F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.2.4p3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"29FAB224-3493-4273-A655-10BE44F5B5BE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.2.4p4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"093F0DD2-9E88-4138-AFF5-69105E7F2C92\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.2.4p5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B3590927-E242-411D-822A-33337D6B8A4B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.2.4p6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"20FCD55C-D4A8-4544-81AF-C920B3B48A2F\"}]}]}],\"references\":[{\"url\":\"ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-006.txt.asc\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://bugs.pardus.org.tr/show_bug.cgi?id=9532\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://lists.apple.com/archives/security-announce/2009/May/msg00002.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://marc.info/?l=bugtraq\u0026m=136482797910018\u0026w=2\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://marc.info/?l=bugtraq\u0026m=136482797910018\u0026w=2\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://ntp.bkbits.net:8080/ntp-stable/?PAGE=gnupatch\u0026REV=1.1565\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://osvdb.org/53593\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2009-1039.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2009-1040.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://secunia.com/advisories/34608\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/35074\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/35137\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/35138\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/35166\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/35169\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/35253\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/35308\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/35336\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/35416\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/35630\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/37471\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://slackware.com/security/viewer.php?l=slackware-security\u0026y=2009\u0026m=slackware-security.566238\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://support.apple.com/kb/HT3549\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.debian.org/security/2009/dsa-1801\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.gentoo.org/security/en/glsa/glsa-200905-08.xml\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.mandriva.com/security/advisories?name=MDVSA-2009:092\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securityfocus.com/archive/1/507985/100/0/threaded\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securityfocus.com/bid/34481\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\"]},{\"url\":\"http://www.securitytracker.com/id?1022033\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.us-cert.gov/cas/techalerts/TA09-133A.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"US Government Resource\"]},{\"url\":\"http://www.vmware.com/security/advisories/VMSA-2009-0016.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.vupen.com/english/advisories/2009/0999\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.vupen.com/english/advisories/2009/1297\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.vupen.com/english/advisories/2009/3316\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=490617\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/49838\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19392\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5411\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8386\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8665\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9634\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://rhn.redhat.com/errata/RHSA-2009-1651.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://support.ntp.org/bugs/show_bug.cgi?id=1144\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\"]},{\"url\":\"https://usn.ubuntu.com/777-1/\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01414.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01449.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-006.txt.asc\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://bugs.pardus.org.tr/show_bug.cgi?id=9532\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://lists.apple.com/archives/security-announce/2009/May/msg00002.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://marc.info/?l=bugtraq\u0026m=136482797910018\u0026w=2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://marc.info/?l=bugtraq\u0026m=136482797910018\u0026w=2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://ntp.bkbits.net:8080/ntp-stable/?PAGE=gnupatch\u0026REV=1.1565\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://osvdb.org/53593\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2009-1039.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2009-1040.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://secunia.com/advisories/34608\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/35074\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/35137\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/35138\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/35166\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/35169\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/35253\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/35308\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/35336\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/35416\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/35630\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/37471\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://slackware.com/security/viewer.php?l=slackware-security\u0026y=2009\u0026m=slackware-security.566238\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://support.apple.com/kb/HT3549\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.debian.org/security/2009/dsa-1801\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.gentoo.org/security/en/glsa/glsa-200905-08.xml\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.mandriva.com/security/advisories?name=MDVSA-2009:092\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securityfocus.com/archive/1/507985/100/0/threaded\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securityfocus.com/bid/34481\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"http://www.securitytracker.com/id?1022033\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.us-cert.gov/cas/techalerts/TA09-133A.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"US Government Resource\"]},{\"url\":\"http://www.vmware.com/security/advisories/VMSA-2009-0016.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.vupen.com/english/advisories/2009/0999\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.vupen.com/english/advisories/2009/1297\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.vupen.com/english/advisories/2009/3316\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=490617\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/49838\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19392\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5411\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8386\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8665\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9634\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://rhn.redhat.com/errata/RHSA-2009-1651.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://support.ntp.org/bugs/show_bug.cgi?id=1144\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://usn.ubuntu.com/777-1/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01414.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01449.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
}
}
rhsa-2009:1040
Vulnerability from csaf_redhat
Published
2009-05-18 20:51
Modified
2025-10-09 13:17
Summary
Red Hat Security Advisory: ntp security update
Notes
Topic
An updated ntp package that fixes two security issues is now available for
Red Hat Enterprise Linux 4.
This update has been rated as having critical security impact by the Red
Hat Security Response Team.
Details
The Network Time Protocol (NTP) is used to synchronize a computer's time
with a referenced time source.
A buffer overflow flaw was discovered in the ntpd daemon's NTPv4
authentication code. If ntpd was configured to use public key cryptography
for NTP packet authentication, a remote attacker could use this flaw to
send a specially-crafted request packet that could crash ntpd or,
potentially, execute arbitrary code with the privileges of the "ntp" user.
(CVE-2009-1252)
Note: NTP authentication is not enabled by default.
A buffer overflow flaw was found in the ntpq diagnostic command. A
malicious, remote server could send a specially-crafted reply to an ntpq
request that could crash ntpq or, potentially, execute arbitrary code with
the privileges of the user running the ntpq command. (CVE-2009-0159)
All ntp users are advised to upgrade to this updated package, which
contains backported patches to resolve these issues. After installing the
update, the ntpd daemon will be restarted automatically.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Critical"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An updated ntp package that fixes two security issues is now available for\nRed Hat Enterprise Linux 4.\n\nThis update has been rated as having critical security impact by the Red\nHat Security Response Team.",
"title": "Topic"
},
{
"category": "general",
"text": "The Network Time Protocol (NTP) is used to synchronize a computer\u0027s time\nwith a referenced time source.\n\nA buffer overflow flaw was discovered in the ntpd daemon\u0027s NTPv4\nauthentication code. If ntpd was configured to use public key cryptography\nfor NTP packet authentication, a remote attacker could use this flaw to\nsend a specially-crafted request packet that could crash ntpd or,\npotentially, execute arbitrary code with the privileges of the \"ntp\" user.\n(CVE-2009-1252)\n\nNote: NTP authentication is not enabled by default.\n\nA buffer overflow flaw was found in the ntpq diagnostic command. A\nmalicious, remote server could send a specially-crafted reply to an ntpq\nrequest that could crash ntpq or, potentially, execute arbitrary code with\nthe privileges of the user running the ntpq command. (CVE-2009-0159)\n\nAll ntp users are advised to upgrade to this updated package, which\ncontains backported patches to resolve these issues. After installing the\nupdate, the ntpd daemon will be restarted automatically.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2009:1040",
"url": "https://access.redhat.com/errata/RHSA-2009:1040"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#critical",
"url": "https://access.redhat.com/security/updates/classification/#critical"
},
{
"category": "external",
"summary": "490617",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=490617"
},
{
"category": "external",
"summary": "499694",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=499694"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_1040.json"
}
],
"title": "Red Hat Security Advisory: ntp security update",
"tracking": {
"current_release_date": "2025-10-09T13:17:05+00:00",
"generator": {
"date": "2025-10-09T13:17:05+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.9"
}
},
"id": "RHSA-2009:1040",
"initial_release_date": "2009-05-18T20:51:00+00:00",
"revision_history": [
{
"date": "2009-05-18T20:51:00+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2009-05-18T16:53:21+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-10-09T13:17:05+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AS version 4",
"product": {
"name": "Red Hat Enterprise Linux AS version 4",
"product_id": "4AS",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:4::as"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Desktop version 4",
"product": {
"name": "Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:4::desktop"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux ES version 4",
"product": {
"name": "Red Hat Enterprise Linux ES version 4",
"product_id": "4ES",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:4::es"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux WS version 4",
"product": {
"name": "Red Hat Enterprise Linux WS version 4",
"product_id": "4WS",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:4::ws"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AS EUS (v. 4.7)",
"product": {
"name": "Red Hat Enterprise Linux AS EUS (v. 4.7)",
"product_id": "4AS-4.7.z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:rhel_eus:4.7::as"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux ES EUS (v. 4.7)",
"product": {
"name": "Red Hat Enterprise Linux ES EUS (v. 4.7)",
"product_id": "4ES-4.7.z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:rhel_eus:4.7::es"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"product": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"product_id": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp@4.2.0.a.20040617-8.el4_7.2?arch=ia64"
}
}
},
{
"category": "product_version",
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"product": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"product_id": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp-debuginfo@4.2.0.a.20040617-8.el4_7.2?arch=ia64"
}
}
}
],
"category": "architecture",
"name": "ia64"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"product": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"product_id": "ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp@4.2.0.a.20040617-8.el4_7.2?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"product": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"product_id": "ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp@4.2.0.a.20040617-8.el4_7.2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"product": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"product_id": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp-debuginfo@4.2.0.a.20040617-8.el4_7.2?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"product": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"product_id": "ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp@4.2.0.a.20040617-8.el4_7.2?arch=i386"
}
}
},
{
"category": "product_version",
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"product": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"product_id": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp-debuginfo@4.2.0.a.20040617-8.el4_7.2?arch=i386"
}
}
}
],
"category": "architecture",
"name": "i386"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"product": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"product_id": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp@4.2.0.a.20040617-8.el4_7.2?arch=ppc"
}
}
},
{
"category": "product_version",
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"product": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"product_id": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp-debuginfo@4.2.0.a.20040617-8.el4_7.2?arch=ppc"
}
}
}
],
"category": "architecture",
"name": "ppc"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"product": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"product_id": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp@4.2.0.a.20040617-8.el4_7.2?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"product": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"product_id": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp-debuginfo@4.2.0.a.20040617-8.el4_7.2?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"product": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"product_id": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp@4.2.0.a.20040617-8.el4_7.2?arch=s390"
}
}
},
{
"category": "product_version",
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"product": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"product_id": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp-debuginfo@4.2.0.a.20040617-8.el4_7.2?arch=s390"
}
}
}
],
"category": "architecture",
"name": "s390"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.i386 as a component of Red Hat Enterprise Linux AS EUS (v. 4.7)",
"product_id": "4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"relates_to_product_reference": "4AS-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64 as a component of Red Hat Enterprise Linux AS EUS (v. 4.7)",
"product_id": "4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"relates_to_product_reference": "4AS-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc as a component of Red Hat Enterprise Linux AS EUS (v. 4.7)",
"product_id": "4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"relates_to_product_reference": "4AS-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390 as a component of Red Hat Enterprise Linux AS EUS (v. 4.7)",
"product_id": "4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"relates_to_product_reference": "4AS-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x as a component of Red Hat Enterprise Linux AS EUS (v. 4.7)",
"product_id": "4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"relates_to_product_reference": "4AS-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.src as a component of Red Hat Enterprise Linux AS EUS (v. 4.7)",
"product_id": "4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.src"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"relates_to_product_reference": "4AS-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64 as a component of Red Hat Enterprise Linux AS EUS (v. 4.7)",
"product_id": "4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"relates_to_product_reference": "4AS-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386 as a component of Red Hat Enterprise Linux AS EUS (v. 4.7)",
"product_id": "4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"relates_to_product_reference": "4AS-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64 as a component of Red Hat Enterprise Linux AS EUS (v. 4.7)",
"product_id": "4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"relates_to_product_reference": "4AS-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc as a component of Red Hat Enterprise Linux AS EUS (v. 4.7)",
"product_id": "4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"relates_to_product_reference": "4AS-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390 as a component of Red Hat Enterprise Linux AS EUS (v. 4.7)",
"product_id": "4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"relates_to_product_reference": "4AS-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x as a component of Red Hat Enterprise Linux AS EUS (v. 4.7)",
"product_id": "4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"relates_to_product_reference": "4AS-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64 as a component of Red Hat Enterprise Linux AS EUS (v. 4.7)",
"product_id": "4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"relates_to_product_reference": "4AS-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.i386 as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64 as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390 as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.src as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.src"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64 as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386 as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64 as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390 as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64 as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.i386 as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64 as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390 as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.src as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.src"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64 as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386 as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64 as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390 as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64 as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.i386 as a component of Red Hat Enterprise Linux ES EUS (v. 4.7)",
"product_id": "4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"relates_to_product_reference": "4ES-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64 as a component of Red Hat Enterprise Linux ES EUS (v. 4.7)",
"product_id": "4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"relates_to_product_reference": "4ES-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc as a component of Red Hat Enterprise Linux ES EUS (v. 4.7)",
"product_id": "4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"relates_to_product_reference": "4ES-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390 as a component of Red Hat Enterprise Linux ES EUS (v. 4.7)",
"product_id": "4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"relates_to_product_reference": "4ES-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x as a component of Red Hat Enterprise Linux ES EUS (v. 4.7)",
"product_id": "4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"relates_to_product_reference": "4ES-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.src as a component of Red Hat Enterprise Linux ES EUS (v. 4.7)",
"product_id": "4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.src"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"relates_to_product_reference": "4ES-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64 as a component of Red Hat Enterprise Linux ES EUS (v. 4.7)",
"product_id": "4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"relates_to_product_reference": "4ES-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386 as a component of Red Hat Enterprise Linux ES EUS (v. 4.7)",
"product_id": "4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"relates_to_product_reference": "4ES-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64 as a component of Red Hat Enterprise Linux ES EUS (v. 4.7)",
"product_id": "4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"relates_to_product_reference": "4ES-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc as a component of Red Hat Enterprise Linux ES EUS (v. 4.7)",
"product_id": "4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"relates_to_product_reference": "4ES-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390 as a component of Red Hat Enterprise Linux ES EUS (v. 4.7)",
"product_id": "4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"relates_to_product_reference": "4ES-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x as a component of Red Hat Enterprise Linux ES EUS (v. 4.7)",
"product_id": "4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"relates_to_product_reference": "4ES-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64 as a component of Red Hat Enterprise Linux ES EUS (v. 4.7)",
"product_id": "4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"relates_to_product_reference": "4ES-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.i386 as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64 as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390 as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.src as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.src"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64 as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386 as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64 as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390 as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64 as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.i386 as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"relates_to_product_reference": "4WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64 as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"relates_to_product_reference": "4WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"relates_to_product_reference": "4WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390 as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"relates_to_product_reference": "4WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"relates_to_product_reference": "4WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.src as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.src"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"relates_to_product_reference": "4WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64 as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"relates_to_product_reference": "4WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386 as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"relates_to_product_reference": "4WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64 as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"relates_to_product_reference": "4WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"relates_to_product_reference": "4WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390 as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"relates_to_product_reference": "4WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"relates_to_product_reference": "4WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64 as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"relates_to_product_reference": "4WS"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2009-0159",
"cwe": {
"id": "CWE-121",
"name": "Stack-based Buffer Overflow"
},
"discovery_date": "2009-03-12T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "490617"
}
],
"notes": [
{
"category": "description",
"text": "Stack-based buffer overflow in the cookedprint function in ntpq/ntpq.c in ntpq in NTP before 4.2.4p7-RC2 allows remote NTP servers to execute arbitrary code via a crafted response.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ntp: buffer overflow in ntpq",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2009-0159"
},
{
"category": "external",
"summary": "RHBZ#490617",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=490617"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2009-0159",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0159"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-0159",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2009-0159"
}
],
"release_date": "2009-04-09T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2009-05-18T20:51:00+00:00",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2009:1040"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "ntp: buffer overflow in ntpq"
},
{
"cve": "CVE-2009-1252",
"cwe": {
"id": "CWE-121",
"name": "Stack-based Buffer Overflow"
},
"discovery_date": "2009-05-06T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "499694"
}
],
"notes": [
{
"category": "description",
"text": "Stack-based buffer overflow in the crypto_recv function in ntp_crypto.c in ntpd in NTP before 4.2.4p7 and 4.2.5 before 4.2.5p74, when OpenSSL and autokey are enabled, allows remote attackers to execute arbitrary code via a crafted packet containing an extension field.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ntp: remote arbitrary code execution vulnerability if autokeys is enabled",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2009-1252"
},
{
"category": "external",
"summary": "RHBZ#499694",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=499694"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2009-1252",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-1252"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-1252",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2009-1252"
}
],
"release_date": "2009-05-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2009-05-18T20:51:00+00:00",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2009:1040"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "ntp: remote arbitrary code execution vulnerability if autokeys is enabled"
}
]
}
rhsa-2009:1651
Vulnerability from csaf_redhat
Published
2009-12-08 19:42
Modified
2025-10-09 13:19
Summary
Red Hat Security Advisory: ntp security update
Notes
Topic
An updated ntp package that fixes two security issues is now available for
Red Hat Enterprise Linux 3.
This update has been rated as having moderate security impact by the Red
Hat Security Response Team.
Details
The Network Time Protocol (NTP) is used to synchronize a computer's time
with a referenced time source.
Robin Park and Dmitri Vinokurov discovered a flaw in the way ntpd handled
certain malformed NTP packets. ntpd logged information about all such
packets and replied with an NTP packet that was treated as malformed when
received by another ntpd. A remote attacker could use this flaw to create
an NTP packet reply loop between two ntpd servers via a malformed packet
with a spoofed source IP address and port, causing ntpd on those servers to
use excessive amounts of CPU time and fill disk space with log messages.
(CVE-2009-3563)
A buffer overflow flaw was found in the ntpq diagnostic command. A
malicious, remote server could send a specially-crafted reply to an ntpq
request that could crash ntpq or, potentially, execute arbitrary code with
the privileges of the user running the ntpq command. (CVE-2009-0159)
All ntp users are advised to upgrade to this updated package, which
contains backported patches to resolve these issues. After installing the
update, the ntpd daemon will restart automatically.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An updated ntp package that fixes two security issues is now available for\nRed Hat Enterprise Linux 3.\n\nThis update has been rated as having moderate security impact by the Red\nHat Security Response Team.",
"title": "Topic"
},
{
"category": "general",
"text": "The Network Time Protocol (NTP) is used to synchronize a computer\u0027s time\nwith a referenced time source.\n\nRobin Park and Dmitri Vinokurov discovered a flaw in the way ntpd handled\ncertain malformed NTP packets. ntpd logged information about all such\npackets and replied with an NTP packet that was treated as malformed when\nreceived by another ntpd. A remote attacker could use this flaw to create\nan NTP packet reply loop between two ntpd servers via a malformed packet\nwith a spoofed source IP address and port, causing ntpd on those servers to\nuse excessive amounts of CPU time and fill disk space with log messages.\n(CVE-2009-3563)\n\nA buffer overflow flaw was found in the ntpq diagnostic command. A\nmalicious, remote server could send a specially-crafted reply to an ntpq\nrequest that could crash ntpq or, potentially, execute arbitrary code with\nthe privileges of the user running the ntpq command. (CVE-2009-0159)\n\nAll ntp users are advised to upgrade to this updated package, which\ncontains backported patches to resolve these issues. After installing the\nupdate, the ntpd daemon will restart automatically.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2009:1651",
"url": "https://access.redhat.com/errata/RHSA-2009:1651"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "490617",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=490617"
},
{
"category": "external",
"summary": "531213",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=531213"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_1651.json"
}
],
"title": "Red Hat Security Advisory: ntp security update",
"tracking": {
"current_release_date": "2025-10-09T13:19:04+00:00",
"generator": {
"date": "2025-10-09T13:19:04+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.9"
}
},
"id": "RHSA-2009:1651",
"initial_release_date": "2009-12-08T19:42:00+00:00",
"revision_history": [
{
"date": "2009-12-08T19:42:00+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2009-12-08T14:50:43+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-10-09T13:19:04+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AS version 3",
"product": {
"name": "Red Hat Enterprise Linux AS version 3",
"product_id": "3AS",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:3::as"
}
}
},
{
"category": "product_name",
"name": "Red Hat Desktop version 3",
"product": {
"name": "Red Hat Desktop version 3",
"product_id": "3Desktop",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:3::desktop"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux ES version 3",
"product": {
"name": "Red Hat Enterprise Linux ES version 3",
"product_id": "3ES",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:3::es"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux WS version 3",
"product": {
"name": "Red Hat Enterprise Linux WS version 3",
"product_id": "3WS",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:3::ws"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-debuginfo-0:4.1.2-6.el3.ia64",
"product": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.ia64",
"product_id": "ntp-debuginfo-0:4.1.2-6.el3.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp-debuginfo@4.1.2-6.el3?arch=ia64"
}
}
},
{
"category": "product_version",
"name": "ntp-0:4.1.2-6.el3.ia64",
"product": {
"name": "ntp-0:4.1.2-6.el3.ia64",
"product_id": "ntp-0:4.1.2-6.el3.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp@4.1.2-6.el3?arch=ia64"
}
}
}
],
"category": "architecture",
"name": "ia64"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"product": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"product_id": "ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp-debuginfo@4.1.2-6.el3?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "ntp-0:4.1.2-6.el3.x86_64",
"product": {
"name": "ntp-0:4.1.2-6.el3.x86_64",
"product_id": "ntp-0:4.1.2-6.el3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp@4.1.2-6.el3?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-debuginfo-0:4.1.2-6.el3.i386",
"product": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.i386",
"product_id": "ntp-debuginfo-0:4.1.2-6.el3.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp-debuginfo@4.1.2-6.el3?arch=i386"
}
}
},
{
"category": "product_version",
"name": "ntp-0:4.1.2-6.el3.i386",
"product": {
"name": "ntp-0:4.1.2-6.el3.i386",
"product_id": "ntp-0:4.1.2-6.el3.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp@4.1.2-6.el3?arch=i386"
}
}
}
],
"category": "architecture",
"name": "i386"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-0:4.1.2-6.el3.src",
"product": {
"name": "ntp-0:4.1.2-6.el3.src",
"product_id": "ntp-0:4.1.2-6.el3.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp@4.1.2-6.el3?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-debuginfo-0:4.1.2-6.el3.ppc",
"product": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.ppc",
"product_id": "ntp-debuginfo-0:4.1.2-6.el3.ppc",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp-debuginfo@4.1.2-6.el3?arch=ppc"
}
}
},
{
"category": "product_version",
"name": "ntp-0:4.1.2-6.el3.ppc",
"product": {
"name": "ntp-0:4.1.2-6.el3.ppc",
"product_id": "ntp-0:4.1.2-6.el3.ppc",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp@4.1.2-6.el3?arch=ppc"
}
}
}
],
"category": "architecture",
"name": "ppc"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-debuginfo-0:4.1.2-6.el3.s390x",
"product": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.s390x",
"product_id": "ntp-debuginfo-0:4.1.2-6.el3.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp-debuginfo@4.1.2-6.el3?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "ntp-0:4.1.2-6.el3.s390x",
"product": {
"name": "ntp-0:4.1.2-6.el3.s390x",
"product_id": "ntp-0:4.1.2-6.el3.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp@4.1.2-6.el3?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-debuginfo-0:4.1.2-6.el3.s390",
"product": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.s390",
"product_id": "ntp-debuginfo-0:4.1.2-6.el3.s390",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp-debuginfo@4.1.2-6.el3?arch=s390"
}
}
},
{
"category": "product_version",
"name": "ntp-0:4.1.2-6.el3.s390",
"product": {
"name": "ntp-0:4.1.2-6.el3.s390",
"product_id": "ntp-0:4.1.2-6.el3.s390",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp@4.1.2-6.el3?arch=s390"
}
}
}
],
"category": "architecture",
"name": "s390"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.i386 as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:ntp-0:4.1.2-6.el3.i386"
},
"product_reference": "ntp-0:4.1.2-6.el3.i386",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.ia64 as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:ntp-0:4.1.2-6.el3.ia64"
},
"product_reference": "ntp-0:4.1.2-6.el3.ia64",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.ppc as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:ntp-0:4.1.2-6.el3.ppc"
},
"product_reference": "ntp-0:4.1.2-6.el3.ppc",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.s390 as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:ntp-0:4.1.2-6.el3.s390"
},
"product_reference": "ntp-0:4.1.2-6.el3.s390",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.s390x as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:ntp-0:4.1.2-6.el3.s390x"
},
"product_reference": "ntp-0:4.1.2-6.el3.s390x",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.src as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:ntp-0:4.1.2-6.el3.src"
},
"product_reference": "ntp-0:4.1.2-6.el3.src",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.x86_64 as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:ntp-0:4.1.2-6.el3.x86_64"
},
"product_reference": "ntp-0:4.1.2-6.el3.x86_64",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.i386 as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:ntp-debuginfo-0:4.1.2-6.el3.i386"
},
"product_reference": "ntp-debuginfo-0:4.1.2-6.el3.i386",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.ia64 as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:ntp-debuginfo-0:4.1.2-6.el3.ia64"
},
"product_reference": "ntp-debuginfo-0:4.1.2-6.el3.ia64",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.ppc as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:ntp-debuginfo-0:4.1.2-6.el3.ppc"
},
"product_reference": "ntp-debuginfo-0:4.1.2-6.el3.ppc",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.s390 as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:ntp-debuginfo-0:4.1.2-6.el3.s390"
},
"product_reference": "ntp-debuginfo-0:4.1.2-6.el3.s390",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.s390x as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:ntp-debuginfo-0:4.1.2-6.el3.s390x"
},
"product_reference": "ntp-debuginfo-0:4.1.2-6.el3.s390x",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.x86_64 as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:ntp-debuginfo-0:4.1.2-6.el3.x86_64"
},
"product_reference": "ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.i386 as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:ntp-0:4.1.2-6.el3.i386"
},
"product_reference": "ntp-0:4.1.2-6.el3.i386",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.ia64 as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:ntp-0:4.1.2-6.el3.ia64"
},
"product_reference": "ntp-0:4.1.2-6.el3.ia64",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.ppc as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:ntp-0:4.1.2-6.el3.ppc"
},
"product_reference": "ntp-0:4.1.2-6.el3.ppc",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.s390 as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:ntp-0:4.1.2-6.el3.s390"
},
"product_reference": "ntp-0:4.1.2-6.el3.s390",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.s390x as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:ntp-0:4.1.2-6.el3.s390x"
},
"product_reference": "ntp-0:4.1.2-6.el3.s390x",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.src as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:ntp-0:4.1.2-6.el3.src"
},
"product_reference": "ntp-0:4.1.2-6.el3.src",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.x86_64 as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:ntp-0:4.1.2-6.el3.x86_64"
},
"product_reference": "ntp-0:4.1.2-6.el3.x86_64",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.i386 as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:ntp-debuginfo-0:4.1.2-6.el3.i386"
},
"product_reference": "ntp-debuginfo-0:4.1.2-6.el3.i386",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.ia64 as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:ntp-debuginfo-0:4.1.2-6.el3.ia64"
},
"product_reference": "ntp-debuginfo-0:4.1.2-6.el3.ia64",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.ppc as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:ntp-debuginfo-0:4.1.2-6.el3.ppc"
},
"product_reference": "ntp-debuginfo-0:4.1.2-6.el3.ppc",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.s390 as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:ntp-debuginfo-0:4.1.2-6.el3.s390"
},
"product_reference": "ntp-debuginfo-0:4.1.2-6.el3.s390",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.s390x as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:ntp-debuginfo-0:4.1.2-6.el3.s390x"
},
"product_reference": "ntp-debuginfo-0:4.1.2-6.el3.s390x",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.x86_64 as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:ntp-debuginfo-0:4.1.2-6.el3.x86_64"
},
"product_reference": "ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.i386 as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:ntp-0:4.1.2-6.el3.i386"
},
"product_reference": "ntp-0:4.1.2-6.el3.i386",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.ia64 as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:ntp-0:4.1.2-6.el3.ia64"
},
"product_reference": "ntp-0:4.1.2-6.el3.ia64",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.ppc as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:ntp-0:4.1.2-6.el3.ppc"
},
"product_reference": "ntp-0:4.1.2-6.el3.ppc",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.s390 as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:ntp-0:4.1.2-6.el3.s390"
},
"product_reference": "ntp-0:4.1.2-6.el3.s390",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.s390x as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:ntp-0:4.1.2-6.el3.s390x"
},
"product_reference": "ntp-0:4.1.2-6.el3.s390x",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.src as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:ntp-0:4.1.2-6.el3.src"
},
"product_reference": "ntp-0:4.1.2-6.el3.src",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.x86_64 as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:ntp-0:4.1.2-6.el3.x86_64"
},
"product_reference": "ntp-0:4.1.2-6.el3.x86_64",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.i386 as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:ntp-debuginfo-0:4.1.2-6.el3.i386"
},
"product_reference": "ntp-debuginfo-0:4.1.2-6.el3.i386",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.ia64 as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:ntp-debuginfo-0:4.1.2-6.el3.ia64"
},
"product_reference": "ntp-debuginfo-0:4.1.2-6.el3.ia64",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.ppc as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:ntp-debuginfo-0:4.1.2-6.el3.ppc"
},
"product_reference": "ntp-debuginfo-0:4.1.2-6.el3.ppc",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.s390 as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:ntp-debuginfo-0:4.1.2-6.el3.s390"
},
"product_reference": "ntp-debuginfo-0:4.1.2-6.el3.s390",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.s390x as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:ntp-debuginfo-0:4.1.2-6.el3.s390x"
},
"product_reference": "ntp-debuginfo-0:4.1.2-6.el3.s390x",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.x86_64 as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:ntp-debuginfo-0:4.1.2-6.el3.x86_64"
},
"product_reference": "ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.i386 as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:ntp-0:4.1.2-6.el3.i386"
},
"product_reference": "ntp-0:4.1.2-6.el3.i386",
"relates_to_product_reference": "3WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.ia64 as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:ntp-0:4.1.2-6.el3.ia64"
},
"product_reference": "ntp-0:4.1.2-6.el3.ia64",
"relates_to_product_reference": "3WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.ppc as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:ntp-0:4.1.2-6.el3.ppc"
},
"product_reference": "ntp-0:4.1.2-6.el3.ppc",
"relates_to_product_reference": "3WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.s390 as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:ntp-0:4.1.2-6.el3.s390"
},
"product_reference": "ntp-0:4.1.2-6.el3.s390",
"relates_to_product_reference": "3WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.s390x as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:ntp-0:4.1.2-6.el3.s390x"
},
"product_reference": "ntp-0:4.1.2-6.el3.s390x",
"relates_to_product_reference": "3WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.src as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:ntp-0:4.1.2-6.el3.src"
},
"product_reference": "ntp-0:4.1.2-6.el3.src",
"relates_to_product_reference": "3WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.x86_64 as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:ntp-0:4.1.2-6.el3.x86_64"
},
"product_reference": "ntp-0:4.1.2-6.el3.x86_64",
"relates_to_product_reference": "3WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.i386 as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:ntp-debuginfo-0:4.1.2-6.el3.i386"
},
"product_reference": "ntp-debuginfo-0:4.1.2-6.el3.i386",
"relates_to_product_reference": "3WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.ia64 as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:ntp-debuginfo-0:4.1.2-6.el3.ia64"
},
"product_reference": "ntp-debuginfo-0:4.1.2-6.el3.ia64",
"relates_to_product_reference": "3WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.ppc as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:ntp-debuginfo-0:4.1.2-6.el3.ppc"
},
"product_reference": "ntp-debuginfo-0:4.1.2-6.el3.ppc",
"relates_to_product_reference": "3WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.s390 as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:ntp-debuginfo-0:4.1.2-6.el3.s390"
},
"product_reference": "ntp-debuginfo-0:4.1.2-6.el3.s390",
"relates_to_product_reference": "3WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.s390x as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:ntp-debuginfo-0:4.1.2-6.el3.s390x"
},
"product_reference": "ntp-debuginfo-0:4.1.2-6.el3.s390x",
"relates_to_product_reference": "3WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.x86_64 as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:ntp-debuginfo-0:4.1.2-6.el3.x86_64"
},
"product_reference": "ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"relates_to_product_reference": "3WS"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2009-0159",
"cwe": {
"id": "CWE-121",
"name": "Stack-based Buffer Overflow"
},
"discovery_date": "2009-03-12T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "490617"
}
],
"notes": [
{
"category": "description",
"text": "Stack-based buffer overflow in the cookedprint function in ntpq/ntpq.c in ntpq in NTP before 4.2.4p7-RC2 allows remote NTP servers to execute arbitrary code via a crafted response.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ntp: buffer overflow in ntpq",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"3AS:ntp-0:4.1.2-6.el3.i386",
"3AS:ntp-0:4.1.2-6.el3.ia64",
"3AS:ntp-0:4.1.2-6.el3.ppc",
"3AS:ntp-0:4.1.2-6.el3.s390",
"3AS:ntp-0:4.1.2-6.el3.s390x",
"3AS:ntp-0:4.1.2-6.el3.src",
"3AS:ntp-0:4.1.2-6.el3.x86_64",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.i386",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.ia64",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.ppc",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.s390",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.s390x",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"3Desktop:ntp-0:4.1.2-6.el3.i386",
"3Desktop:ntp-0:4.1.2-6.el3.ia64",
"3Desktop:ntp-0:4.1.2-6.el3.ppc",
"3Desktop:ntp-0:4.1.2-6.el3.s390",
"3Desktop:ntp-0:4.1.2-6.el3.s390x",
"3Desktop:ntp-0:4.1.2-6.el3.src",
"3Desktop:ntp-0:4.1.2-6.el3.x86_64",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.i386",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.ia64",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.ppc",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.s390",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.s390x",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"3ES:ntp-0:4.1.2-6.el3.i386",
"3ES:ntp-0:4.1.2-6.el3.ia64",
"3ES:ntp-0:4.1.2-6.el3.ppc",
"3ES:ntp-0:4.1.2-6.el3.s390",
"3ES:ntp-0:4.1.2-6.el3.s390x",
"3ES:ntp-0:4.1.2-6.el3.src",
"3ES:ntp-0:4.1.2-6.el3.x86_64",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.i386",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.ia64",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.ppc",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.s390",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.s390x",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"3WS:ntp-0:4.1.2-6.el3.i386",
"3WS:ntp-0:4.1.2-6.el3.ia64",
"3WS:ntp-0:4.1.2-6.el3.ppc",
"3WS:ntp-0:4.1.2-6.el3.s390",
"3WS:ntp-0:4.1.2-6.el3.s390x",
"3WS:ntp-0:4.1.2-6.el3.src",
"3WS:ntp-0:4.1.2-6.el3.x86_64",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.i386",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.ia64",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.ppc",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.s390",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.s390x",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2009-0159"
},
{
"category": "external",
"summary": "RHBZ#490617",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=490617"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2009-0159",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0159"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-0159",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2009-0159"
}
],
"release_date": "2009-04-09T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2009-12-08T19:42:00+00:00",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"3AS:ntp-0:4.1.2-6.el3.i386",
"3AS:ntp-0:4.1.2-6.el3.ia64",
"3AS:ntp-0:4.1.2-6.el3.ppc",
"3AS:ntp-0:4.1.2-6.el3.s390",
"3AS:ntp-0:4.1.2-6.el3.s390x",
"3AS:ntp-0:4.1.2-6.el3.src",
"3AS:ntp-0:4.1.2-6.el3.x86_64",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.i386",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.ia64",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.ppc",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.s390",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.s390x",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"3Desktop:ntp-0:4.1.2-6.el3.i386",
"3Desktop:ntp-0:4.1.2-6.el3.ia64",
"3Desktop:ntp-0:4.1.2-6.el3.ppc",
"3Desktop:ntp-0:4.1.2-6.el3.s390",
"3Desktop:ntp-0:4.1.2-6.el3.s390x",
"3Desktop:ntp-0:4.1.2-6.el3.src",
"3Desktop:ntp-0:4.1.2-6.el3.x86_64",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.i386",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.ia64",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.ppc",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.s390",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.s390x",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"3ES:ntp-0:4.1.2-6.el3.i386",
"3ES:ntp-0:4.1.2-6.el3.ia64",
"3ES:ntp-0:4.1.2-6.el3.ppc",
"3ES:ntp-0:4.1.2-6.el3.s390",
"3ES:ntp-0:4.1.2-6.el3.s390x",
"3ES:ntp-0:4.1.2-6.el3.src",
"3ES:ntp-0:4.1.2-6.el3.x86_64",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.i386",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.ia64",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.ppc",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.s390",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.s390x",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"3WS:ntp-0:4.1.2-6.el3.i386",
"3WS:ntp-0:4.1.2-6.el3.ia64",
"3WS:ntp-0:4.1.2-6.el3.ppc",
"3WS:ntp-0:4.1.2-6.el3.s390",
"3WS:ntp-0:4.1.2-6.el3.s390x",
"3WS:ntp-0:4.1.2-6.el3.src",
"3WS:ntp-0:4.1.2-6.el3.x86_64",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.i386",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.ia64",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.ppc",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.s390",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.s390x",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2009:1651"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"3AS:ntp-0:4.1.2-6.el3.i386",
"3AS:ntp-0:4.1.2-6.el3.ia64",
"3AS:ntp-0:4.1.2-6.el3.ppc",
"3AS:ntp-0:4.1.2-6.el3.s390",
"3AS:ntp-0:4.1.2-6.el3.s390x",
"3AS:ntp-0:4.1.2-6.el3.src",
"3AS:ntp-0:4.1.2-6.el3.x86_64",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.i386",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.ia64",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.ppc",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.s390",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.s390x",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"3Desktop:ntp-0:4.1.2-6.el3.i386",
"3Desktop:ntp-0:4.1.2-6.el3.ia64",
"3Desktop:ntp-0:4.1.2-6.el3.ppc",
"3Desktop:ntp-0:4.1.2-6.el3.s390",
"3Desktop:ntp-0:4.1.2-6.el3.s390x",
"3Desktop:ntp-0:4.1.2-6.el3.src",
"3Desktop:ntp-0:4.1.2-6.el3.x86_64",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.i386",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.ia64",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.ppc",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.s390",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.s390x",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"3ES:ntp-0:4.1.2-6.el3.i386",
"3ES:ntp-0:4.1.2-6.el3.ia64",
"3ES:ntp-0:4.1.2-6.el3.ppc",
"3ES:ntp-0:4.1.2-6.el3.s390",
"3ES:ntp-0:4.1.2-6.el3.s390x",
"3ES:ntp-0:4.1.2-6.el3.src",
"3ES:ntp-0:4.1.2-6.el3.x86_64",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.i386",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.ia64",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.ppc",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.s390",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.s390x",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"3WS:ntp-0:4.1.2-6.el3.i386",
"3WS:ntp-0:4.1.2-6.el3.ia64",
"3WS:ntp-0:4.1.2-6.el3.ppc",
"3WS:ntp-0:4.1.2-6.el3.s390",
"3WS:ntp-0:4.1.2-6.el3.s390x",
"3WS:ntp-0:4.1.2-6.el3.src",
"3WS:ntp-0:4.1.2-6.el3.x86_64",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.i386",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.ia64",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.ppc",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.s390",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.s390x",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "ntp: buffer overflow in ntpq"
},
{
"cve": "CVE-2009-3563",
"discovery_date": "2009-10-27T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "531213"
}
],
"notes": [
{
"category": "description",
"text": "ntp_request.c in ntpd in NTP before 4.2.4p8, and 4.2.5, allows remote attackers to cause a denial of service (CPU and bandwidth consumption) by using MODE_PRIVATE to send a spoofed (1) request or (2) response packet that triggers a continuous exchange of MODE_PRIVATE error responses between two NTP daemons.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ntpd: DoS with mode 7 packets (VU#568372)",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"3AS:ntp-0:4.1.2-6.el3.i386",
"3AS:ntp-0:4.1.2-6.el3.ia64",
"3AS:ntp-0:4.1.2-6.el3.ppc",
"3AS:ntp-0:4.1.2-6.el3.s390",
"3AS:ntp-0:4.1.2-6.el3.s390x",
"3AS:ntp-0:4.1.2-6.el3.src",
"3AS:ntp-0:4.1.2-6.el3.x86_64",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.i386",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.ia64",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.ppc",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.s390",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.s390x",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"3Desktop:ntp-0:4.1.2-6.el3.i386",
"3Desktop:ntp-0:4.1.2-6.el3.ia64",
"3Desktop:ntp-0:4.1.2-6.el3.ppc",
"3Desktop:ntp-0:4.1.2-6.el3.s390",
"3Desktop:ntp-0:4.1.2-6.el3.s390x",
"3Desktop:ntp-0:4.1.2-6.el3.src",
"3Desktop:ntp-0:4.1.2-6.el3.x86_64",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.i386",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.ia64",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.ppc",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.s390",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.s390x",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"3ES:ntp-0:4.1.2-6.el3.i386",
"3ES:ntp-0:4.1.2-6.el3.ia64",
"3ES:ntp-0:4.1.2-6.el3.ppc",
"3ES:ntp-0:4.1.2-6.el3.s390",
"3ES:ntp-0:4.1.2-6.el3.s390x",
"3ES:ntp-0:4.1.2-6.el3.src",
"3ES:ntp-0:4.1.2-6.el3.x86_64",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.i386",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.ia64",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.ppc",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.s390",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.s390x",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"3WS:ntp-0:4.1.2-6.el3.i386",
"3WS:ntp-0:4.1.2-6.el3.ia64",
"3WS:ntp-0:4.1.2-6.el3.ppc",
"3WS:ntp-0:4.1.2-6.el3.s390",
"3WS:ntp-0:4.1.2-6.el3.s390x",
"3WS:ntp-0:4.1.2-6.el3.src",
"3WS:ntp-0:4.1.2-6.el3.x86_64",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.i386",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.ia64",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.ppc",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.s390",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.s390x",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2009-3563"
},
{
"category": "external",
"summary": "RHBZ#531213",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=531213"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2009-3563",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-3563"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-3563",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2009-3563"
}
],
"release_date": "2009-12-08T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2009-12-08T19:42:00+00:00",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"3AS:ntp-0:4.1.2-6.el3.i386",
"3AS:ntp-0:4.1.2-6.el3.ia64",
"3AS:ntp-0:4.1.2-6.el3.ppc",
"3AS:ntp-0:4.1.2-6.el3.s390",
"3AS:ntp-0:4.1.2-6.el3.s390x",
"3AS:ntp-0:4.1.2-6.el3.src",
"3AS:ntp-0:4.1.2-6.el3.x86_64",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.i386",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.ia64",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.ppc",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.s390",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.s390x",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"3Desktop:ntp-0:4.1.2-6.el3.i386",
"3Desktop:ntp-0:4.1.2-6.el3.ia64",
"3Desktop:ntp-0:4.1.2-6.el3.ppc",
"3Desktop:ntp-0:4.1.2-6.el3.s390",
"3Desktop:ntp-0:4.1.2-6.el3.s390x",
"3Desktop:ntp-0:4.1.2-6.el3.src",
"3Desktop:ntp-0:4.1.2-6.el3.x86_64",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.i386",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.ia64",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.ppc",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.s390",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.s390x",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"3ES:ntp-0:4.1.2-6.el3.i386",
"3ES:ntp-0:4.1.2-6.el3.ia64",
"3ES:ntp-0:4.1.2-6.el3.ppc",
"3ES:ntp-0:4.1.2-6.el3.s390",
"3ES:ntp-0:4.1.2-6.el3.s390x",
"3ES:ntp-0:4.1.2-6.el3.src",
"3ES:ntp-0:4.1.2-6.el3.x86_64",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.i386",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.ia64",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.ppc",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.s390",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.s390x",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"3WS:ntp-0:4.1.2-6.el3.i386",
"3WS:ntp-0:4.1.2-6.el3.ia64",
"3WS:ntp-0:4.1.2-6.el3.ppc",
"3WS:ntp-0:4.1.2-6.el3.s390",
"3WS:ntp-0:4.1.2-6.el3.s390x",
"3WS:ntp-0:4.1.2-6.el3.src",
"3WS:ntp-0:4.1.2-6.el3.x86_64",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.i386",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.ia64",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.ppc",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.s390",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.s390x",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2009:1651"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"3AS:ntp-0:4.1.2-6.el3.i386",
"3AS:ntp-0:4.1.2-6.el3.ia64",
"3AS:ntp-0:4.1.2-6.el3.ppc",
"3AS:ntp-0:4.1.2-6.el3.s390",
"3AS:ntp-0:4.1.2-6.el3.s390x",
"3AS:ntp-0:4.1.2-6.el3.src",
"3AS:ntp-0:4.1.2-6.el3.x86_64",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.i386",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.ia64",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.ppc",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.s390",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.s390x",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"3Desktop:ntp-0:4.1.2-6.el3.i386",
"3Desktop:ntp-0:4.1.2-6.el3.ia64",
"3Desktop:ntp-0:4.1.2-6.el3.ppc",
"3Desktop:ntp-0:4.1.2-6.el3.s390",
"3Desktop:ntp-0:4.1.2-6.el3.s390x",
"3Desktop:ntp-0:4.1.2-6.el3.src",
"3Desktop:ntp-0:4.1.2-6.el3.x86_64",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.i386",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.ia64",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.ppc",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.s390",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.s390x",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"3ES:ntp-0:4.1.2-6.el3.i386",
"3ES:ntp-0:4.1.2-6.el3.ia64",
"3ES:ntp-0:4.1.2-6.el3.ppc",
"3ES:ntp-0:4.1.2-6.el3.s390",
"3ES:ntp-0:4.1.2-6.el3.s390x",
"3ES:ntp-0:4.1.2-6.el3.src",
"3ES:ntp-0:4.1.2-6.el3.x86_64",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.i386",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.ia64",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.ppc",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.s390",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.s390x",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"3WS:ntp-0:4.1.2-6.el3.i386",
"3WS:ntp-0:4.1.2-6.el3.ia64",
"3WS:ntp-0:4.1.2-6.el3.ppc",
"3WS:ntp-0:4.1.2-6.el3.s390",
"3WS:ntp-0:4.1.2-6.el3.s390x",
"3WS:ntp-0:4.1.2-6.el3.src",
"3WS:ntp-0:4.1.2-6.el3.x86_64",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.i386",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.ia64",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.ppc",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.s390",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.s390x",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "ntpd: DoS with mode 7 packets (VU#568372)"
}
]
}
rhsa-2009_1651
Vulnerability from csaf_redhat
Published
2009-12-08 19:42
Modified
2024-11-22 03:08
Summary
Red Hat Security Advisory: ntp security update
Notes
Topic
An updated ntp package that fixes two security issues is now available for
Red Hat Enterprise Linux 3.
This update has been rated as having moderate security impact by the Red
Hat Security Response Team.
Details
The Network Time Protocol (NTP) is used to synchronize a computer's time
with a referenced time source.
Robin Park and Dmitri Vinokurov discovered a flaw in the way ntpd handled
certain malformed NTP packets. ntpd logged information about all such
packets and replied with an NTP packet that was treated as malformed when
received by another ntpd. A remote attacker could use this flaw to create
an NTP packet reply loop between two ntpd servers via a malformed packet
with a spoofed source IP address and port, causing ntpd on those servers to
use excessive amounts of CPU time and fill disk space with log messages.
(CVE-2009-3563)
A buffer overflow flaw was found in the ntpq diagnostic command. A
malicious, remote server could send a specially-crafted reply to an ntpq
request that could crash ntpq or, potentially, execute arbitrary code with
the privileges of the user running the ntpq command. (CVE-2009-0159)
All ntp users are advised to upgrade to this updated package, which
contains backported patches to resolve these issues. After installing the
update, the ntpd daemon will restart automatically.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An updated ntp package that fixes two security issues is now available for\nRed Hat Enterprise Linux 3.\n\nThis update has been rated as having moderate security impact by the Red\nHat Security Response Team.",
"title": "Topic"
},
{
"category": "general",
"text": "The Network Time Protocol (NTP) is used to synchronize a computer\u0027s time\nwith a referenced time source.\n\nRobin Park and Dmitri Vinokurov discovered a flaw in the way ntpd handled\ncertain malformed NTP packets. ntpd logged information about all such\npackets and replied with an NTP packet that was treated as malformed when\nreceived by another ntpd. A remote attacker could use this flaw to create\nan NTP packet reply loop between two ntpd servers via a malformed packet\nwith a spoofed source IP address and port, causing ntpd on those servers to\nuse excessive amounts of CPU time and fill disk space with log messages.\n(CVE-2009-3563)\n\nA buffer overflow flaw was found in the ntpq diagnostic command. A\nmalicious, remote server could send a specially-crafted reply to an ntpq\nrequest that could crash ntpq or, potentially, execute arbitrary code with\nthe privileges of the user running the ntpq command. (CVE-2009-0159)\n\nAll ntp users are advised to upgrade to this updated package, which\ncontains backported patches to resolve these issues. After installing the\nupdate, the ntpd daemon will restart automatically.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2009:1651",
"url": "https://access.redhat.com/errata/RHSA-2009:1651"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "490617",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=490617"
},
{
"category": "external",
"summary": "531213",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=531213"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_1651.json"
}
],
"title": "Red Hat Security Advisory: ntp security update",
"tracking": {
"current_release_date": "2024-11-22T03:08:17+00:00",
"generator": {
"date": "2024-11-22T03:08:17+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2009:1651",
"initial_release_date": "2009-12-08T19:42:00+00:00",
"revision_history": [
{
"date": "2009-12-08T19:42:00+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2009-12-08T14:50:43+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-22T03:08:17+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AS version 3",
"product": {
"name": "Red Hat Enterprise Linux AS version 3",
"product_id": "3AS",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:3::as"
}
}
},
{
"category": "product_name",
"name": "Red Hat Desktop version 3",
"product": {
"name": "Red Hat Desktop version 3",
"product_id": "3Desktop",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:3::desktop"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux ES version 3",
"product": {
"name": "Red Hat Enterprise Linux ES version 3",
"product_id": "3ES",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:3::es"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux WS version 3",
"product": {
"name": "Red Hat Enterprise Linux WS version 3",
"product_id": "3WS",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:3::ws"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-debuginfo-0:4.1.2-6.el3.ia64",
"product": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.ia64",
"product_id": "ntp-debuginfo-0:4.1.2-6.el3.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp-debuginfo@4.1.2-6.el3?arch=ia64"
}
}
},
{
"category": "product_version",
"name": "ntp-0:4.1.2-6.el3.ia64",
"product": {
"name": "ntp-0:4.1.2-6.el3.ia64",
"product_id": "ntp-0:4.1.2-6.el3.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp@4.1.2-6.el3?arch=ia64"
}
}
}
],
"category": "architecture",
"name": "ia64"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"product": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"product_id": "ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp-debuginfo@4.1.2-6.el3?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "ntp-0:4.1.2-6.el3.x86_64",
"product": {
"name": "ntp-0:4.1.2-6.el3.x86_64",
"product_id": "ntp-0:4.1.2-6.el3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp@4.1.2-6.el3?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-debuginfo-0:4.1.2-6.el3.i386",
"product": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.i386",
"product_id": "ntp-debuginfo-0:4.1.2-6.el3.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp-debuginfo@4.1.2-6.el3?arch=i386"
}
}
},
{
"category": "product_version",
"name": "ntp-0:4.1.2-6.el3.i386",
"product": {
"name": "ntp-0:4.1.2-6.el3.i386",
"product_id": "ntp-0:4.1.2-6.el3.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp@4.1.2-6.el3?arch=i386"
}
}
}
],
"category": "architecture",
"name": "i386"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-0:4.1.2-6.el3.src",
"product": {
"name": "ntp-0:4.1.2-6.el3.src",
"product_id": "ntp-0:4.1.2-6.el3.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp@4.1.2-6.el3?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-debuginfo-0:4.1.2-6.el3.ppc",
"product": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.ppc",
"product_id": "ntp-debuginfo-0:4.1.2-6.el3.ppc",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp-debuginfo@4.1.2-6.el3?arch=ppc"
}
}
},
{
"category": "product_version",
"name": "ntp-0:4.1.2-6.el3.ppc",
"product": {
"name": "ntp-0:4.1.2-6.el3.ppc",
"product_id": "ntp-0:4.1.2-6.el3.ppc",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp@4.1.2-6.el3?arch=ppc"
}
}
}
],
"category": "architecture",
"name": "ppc"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-debuginfo-0:4.1.2-6.el3.s390x",
"product": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.s390x",
"product_id": "ntp-debuginfo-0:4.1.2-6.el3.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp-debuginfo@4.1.2-6.el3?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "ntp-0:4.1.2-6.el3.s390x",
"product": {
"name": "ntp-0:4.1.2-6.el3.s390x",
"product_id": "ntp-0:4.1.2-6.el3.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp@4.1.2-6.el3?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-debuginfo-0:4.1.2-6.el3.s390",
"product": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.s390",
"product_id": "ntp-debuginfo-0:4.1.2-6.el3.s390",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp-debuginfo@4.1.2-6.el3?arch=s390"
}
}
},
{
"category": "product_version",
"name": "ntp-0:4.1.2-6.el3.s390",
"product": {
"name": "ntp-0:4.1.2-6.el3.s390",
"product_id": "ntp-0:4.1.2-6.el3.s390",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp@4.1.2-6.el3?arch=s390"
}
}
}
],
"category": "architecture",
"name": "s390"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.i386 as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:ntp-0:4.1.2-6.el3.i386"
},
"product_reference": "ntp-0:4.1.2-6.el3.i386",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.ia64 as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:ntp-0:4.1.2-6.el3.ia64"
},
"product_reference": "ntp-0:4.1.2-6.el3.ia64",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.ppc as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:ntp-0:4.1.2-6.el3.ppc"
},
"product_reference": "ntp-0:4.1.2-6.el3.ppc",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.s390 as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:ntp-0:4.1.2-6.el3.s390"
},
"product_reference": "ntp-0:4.1.2-6.el3.s390",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.s390x as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:ntp-0:4.1.2-6.el3.s390x"
},
"product_reference": "ntp-0:4.1.2-6.el3.s390x",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.src as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:ntp-0:4.1.2-6.el3.src"
},
"product_reference": "ntp-0:4.1.2-6.el3.src",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.x86_64 as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:ntp-0:4.1.2-6.el3.x86_64"
},
"product_reference": "ntp-0:4.1.2-6.el3.x86_64",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.i386 as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:ntp-debuginfo-0:4.1.2-6.el3.i386"
},
"product_reference": "ntp-debuginfo-0:4.1.2-6.el3.i386",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.ia64 as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:ntp-debuginfo-0:4.1.2-6.el3.ia64"
},
"product_reference": "ntp-debuginfo-0:4.1.2-6.el3.ia64",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.ppc as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:ntp-debuginfo-0:4.1.2-6.el3.ppc"
},
"product_reference": "ntp-debuginfo-0:4.1.2-6.el3.ppc",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.s390 as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:ntp-debuginfo-0:4.1.2-6.el3.s390"
},
"product_reference": "ntp-debuginfo-0:4.1.2-6.el3.s390",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.s390x as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:ntp-debuginfo-0:4.1.2-6.el3.s390x"
},
"product_reference": "ntp-debuginfo-0:4.1.2-6.el3.s390x",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.x86_64 as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:ntp-debuginfo-0:4.1.2-6.el3.x86_64"
},
"product_reference": "ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.i386 as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:ntp-0:4.1.2-6.el3.i386"
},
"product_reference": "ntp-0:4.1.2-6.el3.i386",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.ia64 as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:ntp-0:4.1.2-6.el3.ia64"
},
"product_reference": "ntp-0:4.1.2-6.el3.ia64",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.ppc as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:ntp-0:4.1.2-6.el3.ppc"
},
"product_reference": "ntp-0:4.1.2-6.el3.ppc",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.s390 as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:ntp-0:4.1.2-6.el3.s390"
},
"product_reference": "ntp-0:4.1.2-6.el3.s390",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.s390x as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:ntp-0:4.1.2-6.el3.s390x"
},
"product_reference": "ntp-0:4.1.2-6.el3.s390x",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.src as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:ntp-0:4.1.2-6.el3.src"
},
"product_reference": "ntp-0:4.1.2-6.el3.src",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.x86_64 as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:ntp-0:4.1.2-6.el3.x86_64"
},
"product_reference": "ntp-0:4.1.2-6.el3.x86_64",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.i386 as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:ntp-debuginfo-0:4.1.2-6.el3.i386"
},
"product_reference": "ntp-debuginfo-0:4.1.2-6.el3.i386",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.ia64 as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:ntp-debuginfo-0:4.1.2-6.el3.ia64"
},
"product_reference": "ntp-debuginfo-0:4.1.2-6.el3.ia64",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.ppc as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:ntp-debuginfo-0:4.1.2-6.el3.ppc"
},
"product_reference": "ntp-debuginfo-0:4.1.2-6.el3.ppc",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.s390 as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:ntp-debuginfo-0:4.1.2-6.el3.s390"
},
"product_reference": "ntp-debuginfo-0:4.1.2-6.el3.s390",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.s390x as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:ntp-debuginfo-0:4.1.2-6.el3.s390x"
},
"product_reference": "ntp-debuginfo-0:4.1.2-6.el3.s390x",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.x86_64 as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:ntp-debuginfo-0:4.1.2-6.el3.x86_64"
},
"product_reference": "ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.i386 as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:ntp-0:4.1.2-6.el3.i386"
},
"product_reference": "ntp-0:4.1.2-6.el3.i386",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.ia64 as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:ntp-0:4.1.2-6.el3.ia64"
},
"product_reference": "ntp-0:4.1.2-6.el3.ia64",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.ppc as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:ntp-0:4.1.2-6.el3.ppc"
},
"product_reference": "ntp-0:4.1.2-6.el3.ppc",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.s390 as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:ntp-0:4.1.2-6.el3.s390"
},
"product_reference": "ntp-0:4.1.2-6.el3.s390",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.s390x as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:ntp-0:4.1.2-6.el3.s390x"
},
"product_reference": "ntp-0:4.1.2-6.el3.s390x",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.src as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:ntp-0:4.1.2-6.el3.src"
},
"product_reference": "ntp-0:4.1.2-6.el3.src",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.x86_64 as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:ntp-0:4.1.2-6.el3.x86_64"
},
"product_reference": "ntp-0:4.1.2-6.el3.x86_64",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.i386 as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:ntp-debuginfo-0:4.1.2-6.el3.i386"
},
"product_reference": "ntp-debuginfo-0:4.1.2-6.el3.i386",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.ia64 as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:ntp-debuginfo-0:4.1.2-6.el3.ia64"
},
"product_reference": "ntp-debuginfo-0:4.1.2-6.el3.ia64",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.ppc as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:ntp-debuginfo-0:4.1.2-6.el3.ppc"
},
"product_reference": "ntp-debuginfo-0:4.1.2-6.el3.ppc",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.s390 as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:ntp-debuginfo-0:4.1.2-6.el3.s390"
},
"product_reference": "ntp-debuginfo-0:4.1.2-6.el3.s390",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.s390x as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:ntp-debuginfo-0:4.1.2-6.el3.s390x"
},
"product_reference": "ntp-debuginfo-0:4.1.2-6.el3.s390x",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.x86_64 as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:ntp-debuginfo-0:4.1.2-6.el3.x86_64"
},
"product_reference": "ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.i386 as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:ntp-0:4.1.2-6.el3.i386"
},
"product_reference": "ntp-0:4.1.2-6.el3.i386",
"relates_to_product_reference": "3WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.ia64 as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:ntp-0:4.1.2-6.el3.ia64"
},
"product_reference": "ntp-0:4.1.2-6.el3.ia64",
"relates_to_product_reference": "3WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.ppc as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:ntp-0:4.1.2-6.el3.ppc"
},
"product_reference": "ntp-0:4.1.2-6.el3.ppc",
"relates_to_product_reference": "3WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.s390 as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:ntp-0:4.1.2-6.el3.s390"
},
"product_reference": "ntp-0:4.1.2-6.el3.s390",
"relates_to_product_reference": "3WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.s390x as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:ntp-0:4.1.2-6.el3.s390x"
},
"product_reference": "ntp-0:4.1.2-6.el3.s390x",
"relates_to_product_reference": "3WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.src as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:ntp-0:4.1.2-6.el3.src"
},
"product_reference": "ntp-0:4.1.2-6.el3.src",
"relates_to_product_reference": "3WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.x86_64 as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:ntp-0:4.1.2-6.el3.x86_64"
},
"product_reference": "ntp-0:4.1.2-6.el3.x86_64",
"relates_to_product_reference": "3WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.i386 as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:ntp-debuginfo-0:4.1.2-6.el3.i386"
},
"product_reference": "ntp-debuginfo-0:4.1.2-6.el3.i386",
"relates_to_product_reference": "3WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.ia64 as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:ntp-debuginfo-0:4.1.2-6.el3.ia64"
},
"product_reference": "ntp-debuginfo-0:4.1.2-6.el3.ia64",
"relates_to_product_reference": "3WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.ppc as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:ntp-debuginfo-0:4.1.2-6.el3.ppc"
},
"product_reference": "ntp-debuginfo-0:4.1.2-6.el3.ppc",
"relates_to_product_reference": "3WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.s390 as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:ntp-debuginfo-0:4.1.2-6.el3.s390"
},
"product_reference": "ntp-debuginfo-0:4.1.2-6.el3.s390",
"relates_to_product_reference": "3WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.s390x as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:ntp-debuginfo-0:4.1.2-6.el3.s390x"
},
"product_reference": "ntp-debuginfo-0:4.1.2-6.el3.s390x",
"relates_to_product_reference": "3WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.x86_64 as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:ntp-debuginfo-0:4.1.2-6.el3.x86_64"
},
"product_reference": "ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"relates_to_product_reference": "3WS"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2009-0159",
"cwe": {
"id": "CWE-121",
"name": "Stack-based Buffer Overflow"
},
"discovery_date": "2009-03-12T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "490617"
}
],
"notes": [
{
"category": "description",
"text": "Stack-based buffer overflow in the cookedprint function in ntpq/ntpq.c in ntpq in NTP before 4.2.4p7-RC2 allows remote NTP servers to execute arbitrary code via a crafted response.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ntp: buffer overflow in ntpq",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"3AS:ntp-0:4.1.2-6.el3.i386",
"3AS:ntp-0:4.1.2-6.el3.ia64",
"3AS:ntp-0:4.1.2-6.el3.ppc",
"3AS:ntp-0:4.1.2-6.el3.s390",
"3AS:ntp-0:4.1.2-6.el3.s390x",
"3AS:ntp-0:4.1.2-6.el3.src",
"3AS:ntp-0:4.1.2-6.el3.x86_64",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.i386",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.ia64",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.ppc",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.s390",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.s390x",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"3Desktop:ntp-0:4.1.2-6.el3.i386",
"3Desktop:ntp-0:4.1.2-6.el3.ia64",
"3Desktop:ntp-0:4.1.2-6.el3.ppc",
"3Desktop:ntp-0:4.1.2-6.el3.s390",
"3Desktop:ntp-0:4.1.2-6.el3.s390x",
"3Desktop:ntp-0:4.1.2-6.el3.src",
"3Desktop:ntp-0:4.1.2-6.el3.x86_64",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.i386",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.ia64",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.ppc",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.s390",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.s390x",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"3ES:ntp-0:4.1.2-6.el3.i386",
"3ES:ntp-0:4.1.2-6.el3.ia64",
"3ES:ntp-0:4.1.2-6.el3.ppc",
"3ES:ntp-0:4.1.2-6.el3.s390",
"3ES:ntp-0:4.1.2-6.el3.s390x",
"3ES:ntp-0:4.1.2-6.el3.src",
"3ES:ntp-0:4.1.2-6.el3.x86_64",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.i386",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.ia64",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.ppc",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.s390",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.s390x",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"3WS:ntp-0:4.1.2-6.el3.i386",
"3WS:ntp-0:4.1.2-6.el3.ia64",
"3WS:ntp-0:4.1.2-6.el3.ppc",
"3WS:ntp-0:4.1.2-6.el3.s390",
"3WS:ntp-0:4.1.2-6.el3.s390x",
"3WS:ntp-0:4.1.2-6.el3.src",
"3WS:ntp-0:4.1.2-6.el3.x86_64",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.i386",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.ia64",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.ppc",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.s390",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.s390x",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2009-0159"
},
{
"category": "external",
"summary": "RHBZ#490617",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=490617"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2009-0159",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0159"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-0159",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2009-0159"
}
],
"release_date": "2009-04-09T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2009-12-08T19:42:00+00:00",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"3AS:ntp-0:4.1.2-6.el3.i386",
"3AS:ntp-0:4.1.2-6.el3.ia64",
"3AS:ntp-0:4.1.2-6.el3.ppc",
"3AS:ntp-0:4.1.2-6.el3.s390",
"3AS:ntp-0:4.1.2-6.el3.s390x",
"3AS:ntp-0:4.1.2-6.el3.src",
"3AS:ntp-0:4.1.2-6.el3.x86_64",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.i386",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.ia64",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.ppc",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.s390",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.s390x",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"3Desktop:ntp-0:4.1.2-6.el3.i386",
"3Desktop:ntp-0:4.1.2-6.el3.ia64",
"3Desktop:ntp-0:4.1.2-6.el3.ppc",
"3Desktop:ntp-0:4.1.2-6.el3.s390",
"3Desktop:ntp-0:4.1.2-6.el3.s390x",
"3Desktop:ntp-0:4.1.2-6.el3.src",
"3Desktop:ntp-0:4.1.2-6.el3.x86_64",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.i386",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.ia64",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.ppc",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.s390",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.s390x",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"3ES:ntp-0:4.1.2-6.el3.i386",
"3ES:ntp-0:4.1.2-6.el3.ia64",
"3ES:ntp-0:4.1.2-6.el3.ppc",
"3ES:ntp-0:4.1.2-6.el3.s390",
"3ES:ntp-0:4.1.2-6.el3.s390x",
"3ES:ntp-0:4.1.2-6.el3.src",
"3ES:ntp-0:4.1.2-6.el3.x86_64",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.i386",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.ia64",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.ppc",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.s390",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.s390x",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"3WS:ntp-0:4.1.2-6.el3.i386",
"3WS:ntp-0:4.1.2-6.el3.ia64",
"3WS:ntp-0:4.1.2-6.el3.ppc",
"3WS:ntp-0:4.1.2-6.el3.s390",
"3WS:ntp-0:4.1.2-6.el3.s390x",
"3WS:ntp-0:4.1.2-6.el3.src",
"3WS:ntp-0:4.1.2-6.el3.x86_64",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.i386",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.ia64",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.ppc",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.s390",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.s390x",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2009:1651"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"3AS:ntp-0:4.1.2-6.el3.i386",
"3AS:ntp-0:4.1.2-6.el3.ia64",
"3AS:ntp-0:4.1.2-6.el3.ppc",
"3AS:ntp-0:4.1.2-6.el3.s390",
"3AS:ntp-0:4.1.2-6.el3.s390x",
"3AS:ntp-0:4.1.2-6.el3.src",
"3AS:ntp-0:4.1.2-6.el3.x86_64",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.i386",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.ia64",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.ppc",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.s390",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.s390x",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"3Desktop:ntp-0:4.1.2-6.el3.i386",
"3Desktop:ntp-0:4.1.2-6.el3.ia64",
"3Desktop:ntp-0:4.1.2-6.el3.ppc",
"3Desktop:ntp-0:4.1.2-6.el3.s390",
"3Desktop:ntp-0:4.1.2-6.el3.s390x",
"3Desktop:ntp-0:4.1.2-6.el3.src",
"3Desktop:ntp-0:4.1.2-6.el3.x86_64",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.i386",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.ia64",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.ppc",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.s390",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.s390x",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"3ES:ntp-0:4.1.2-6.el3.i386",
"3ES:ntp-0:4.1.2-6.el3.ia64",
"3ES:ntp-0:4.1.2-6.el3.ppc",
"3ES:ntp-0:4.1.2-6.el3.s390",
"3ES:ntp-0:4.1.2-6.el3.s390x",
"3ES:ntp-0:4.1.2-6.el3.src",
"3ES:ntp-0:4.1.2-6.el3.x86_64",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.i386",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.ia64",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.ppc",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.s390",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.s390x",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"3WS:ntp-0:4.1.2-6.el3.i386",
"3WS:ntp-0:4.1.2-6.el3.ia64",
"3WS:ntp-0:4.1.2-6.el3.ppc",
"3WS:ntp-0:4.1.2-6.el3.s390",
"3WS:ntp-0:4.1.2-6.el3.s390x",
"3WS:ntp-0:4.1.2-6.el3.src",
"3WS:ntp-0:4.1.2-6.el3.x86_64",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.i386",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.ia64",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.ppc",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.s390",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.s390x",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "ntp: buffer overflow in ntpq"
},
{
"cve": "CVE-2009-3563",
"discovery_date": "2009-10-27T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "531213"
}
],
"notes": [
{
"category": "description",
"text": "ntp_request.c in ntpd in NTP before 4.2.4p8, and 4.2.5, allows remote attackers to cause a denial of service (CPU and bandwidth consumption) by using MODE_PRIVATE to send a spoofed (1) request or (2) response packet that triggers a continuous exchange of MODE_PRIVATE error responses between two NTP daemons.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ntpd: DoS with mode 7 packets (VU#568372)",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"3AS:ntp-0:4.1.2-6.el3.i386",
"3AS:ntp-0:4.1.2-6.el3.ia64",
"3AS:ntp-0:4.1.2-6.el3.ppc",
"3AS:ntp-0:4.1.2-6.el3.s390",
"3AS:ntp-0:4.1.2-6.el3.s390x",
"3AS:ntp-0:4.1.2-6.el3.src",
"3AS:ntp-0:4.1.2-6.el3.x86_64",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.i386",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.ia64",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.ppc",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.s390",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.s390x",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"3Desktop:ntp-0:4.1.2-6.el3.i386",
"3Desktop:ntp-0:4.1.2-6.el3.ia64",
"3Desktop:ntp-0:4.1.2-6.el3.ppc",
"3Desktop:ntp-0:4.1.2-6.el3.s390",
"3Desktop:ntp-0:4.1.2-6.el3.s390x",
"3Desktop:ntp-0:4.1.2-6.el3.src",
"3Desktop:ntp-0:4.1.2-6.el3.x86_64",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.i386",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.ia64",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.ppc",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.s390",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.s390x",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"3ES:ntp-0:4.1.2-6.el3.i386",
"3ES:ntp-0:4.1.2-6.el3.ia64",
"3ES:ntp-0:4.1.2-6.el3.ppc",
"3ES:ntp-0:4.1.2-6.el3.s390",
"3ES:ntp-0:4.1.2-6.el3.s390x",
"3ES:ntp-0:4.1.2-6.el3.src",
"3ES:ntp-0:4.1.2-6.el3.x86_64",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.i386",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.ia64",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.ppc",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.s390",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.s390x",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"3WS:ntp-0:4.1.2-6.el3.i386",
"3WS:ntp-0:4.1.2-6.el3.ia64",
"3WS:ntp-0:4.1.2-6.el3.ppc",
"3WS:ntp-0:4.1.2-6.el3.s390",
"3WS:ntp-0:4.1.2-6.el3.s390x",
"3WS:ntp-0:4.1.2-6.el3.src",
"3WS:ntp-0:4.1.2-6.el3.x86_64",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.i386",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.ia64",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.ppc",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.s390",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.s390x",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2009-3563"
},
{
"category": "external",
"summary": "RHBZ#531213",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=531213"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2009-3563",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-3563"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-3563",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2009-3563"
}
],
"release_date": "2009-12-08T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2009-12-08T19:42:00+00:00",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"3AS:ntp-0:4.1.2-6.el3.i386",
"3AS:ntp-0:4.1.2-6.el3.ia64",
"3AS:ntp-0:4.1.2-6.el3.ppc",
"3AS:ntp-0:4.1.2-6.el3.s390",
"3AS:ntp-0:4.1.2-6.el3.s390x",
"3AS:ntp-0:4.1.2-6.el3.src",
"3AS:ntp-0:4.1.2-6.el3.x86_64",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.i386",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.ia64",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.ppc",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.s390",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.s390x",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"3Desktop:ntp-0:4.1.2-6.el3.i386",
"3Desktop:ntp-0:4.1.2-6.el3.ia64",
"3Desktop:ntp-0:4.1.2-6.el3.ppc",
"3Desktop:ntp-0:4.1.2-6.el3.s390",
"3Desktop:ntp-0:4.1.2-6.el3.s390x",
"3Desktop:ntp-0:4.1.2-6.el3.src",
"3Desktop:ntp-0:4.1.2-6.el3.x86_64",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.i386",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.ia64",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.ppc",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.s390",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.s390x",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"3ES:ntp-0:4.1.2-6.el3.i386",
"3ES:ntp-0:4.1.2-6.el3.ia64",
"3ES:ntp-0:4.1.2-6.el3.ppc",
"3ES:ntp-0:4.1.2-6.el3.s390",
"3ES:ntp-0:4.1.2-6.el3.s390x",
"3ES:ntp-0:4.1.2-6.el3.src",
"3ES:ntp-0:4.1.2-6.el3.x86_64",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.i386",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.ia64",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.ppc",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.s390",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.s390x",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"3WS:ntp-0:4.1.2-6.el3.i386",
"3WS:ntp-0:4.1.2-6.el3.ia64",
"3WS:ntp-0:4.1.2-6.el3.ppc",
"3WS:ntp-0:4.1.2-6.el3.s390",
"3WS:ntp-0:4.1.2-6.el3.s390x",
"3WS:ntp-0:4.1.2-6.el3.src",
"3WS:ntp-0:4.1.2-6.el3.x86_64",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.i386",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.ia64",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.ppc",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.s390",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.s390x",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2009:1651"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"3AS:ntp-0:4.1.2-6.el3.i386",
"3AS:ntp-0:4.1.2-6.el3.ia64",
"3AS:ntp-0:4.1.2-6.el3.ppc",
"3AS:ntp-0:4.1.2-6.el3.s390",
"3AS:ntp-0:4.1.2-6.el3.s390x",
"3AS:ntp-0:4.1.2-6.el3.src",
"3AS:ntp-0:4.1.2-6.el3.x86_64",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.i386",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.ia64",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.ppc",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.s390",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.s390x",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"3Desktop:ntp-0:4.1.2-6.el3.i386",
"3Desktop:ntp-0:4.1.2-6.el3.ia64",
"3Desktop:ntp-0:4.1.2-6.el3.ppc",
"3Desktop:ntp-0:4.1.2-6.el3.s390",
"3Desktop:ntp-0:4.1.2-6.el3.s390x",
"3Desktop:ntp-0:4.1.2-6.el3.src",
"3Desktop:ntp-0:4.1.2-6.el3.x86_64",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.i386",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.ia64",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.ppc",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.s390",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.s390x",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"3ES:ntp-0:4.1.2-6.el3.i386",
"3ES:ntp-0:4.1.2-6.el3.ia64",
"3ES:ntp-0:4.1.2-6.el3.ppc",
"3ES:ntp-0:4.1.2-6.el3.s390",
"3ES:ntp-0:4.1.2-6.el3.s390x",
"3ES:ntp-0:4.1.2-6.el3.src",
"3ES:ntp-0:4.1.2-6.el3.x86_64",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.i386",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.ia64",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.ppc",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.s390",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.s390x",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"3WS:ntp-0:4.1.2-6.el3.i386",
"3WS:ntp-0:4.1.2-6.el3.ia64",
"3WS:ntp-0:4.1.2-6.el3.ppc",
"3WS:ntp-0:4.1.2-6.el3.s390",
"3WS:ntp-0:4.1.2-6.el3.s390x",
"3WS:ntp-0:4.1.2-6.el3.src",
"3WS:ntp-0:4.1.2-6.el3.x86_64",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.i386",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.ia64",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.ppc",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.s390",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.s390x",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "ntpd: DoS with mode 7 packets (VU#568372)"
}
]
}
rhsa-2009_1040
Vulnerability from csaf_redhat
Published
2009-05-18 20:51
Modified
2024-11-22 03:08
Summary
Red Hat Security Advisory: ntp security update
Notes
Topic
An updated ntp package that fixes two security issues is now available for
Red Hat Enterprise Linux 4.
This update has been rated as having critical security impact by the Red
Hat Security Response Team.
Details
The Network Time Protocol (NTP) is used to synchronize a computer's time
with a referenced time source.
A buffer overflow flaw was discovered in the ntpd daemon's NTPv4
authentication code. If ntpd was configured to use public key cryptography
for NTP packet authentication, a remote attacker could use this flaw to
send a specially-crafted request packet that could crash ntpd or,
potentially, execute arbitrary code with the privileges of the "ntp" user.
(CVE-2009-1252)
Note: NTP authentication is not enabled by default.
A buffer overflow flaw was found in the ntpq diagnostic command. A
malicious, remote server could send a specially-crafted reply to an ntpq
request that could crash ntpq or, potentially, execute arbitrary code with
the privileges of the user running the ntpq command. (CVE-2009-0159)
All ntp users are advised to upgrade to this updated package, which
contains backported patches to resolve these issues. After installing the
update, the ntpd daemon will be restarted automatically.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Critical"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An updated ntp package that fixes two security issues is now available for\nRed Hat Enterprise Linux 4.\n\nThis update has been rated as having critical security impact by the Red\nHat Security Response Team.",
"title": "Topic"
},
{
"category": "general",
"text": "The Network Time Protocol (NTP) is used to synchronize a computer\u0027s time\nwith a referenced time source.\n\nA buffer overflow flaw was discovered in the ntpd daemon\u0027s NTPv4\nauthentication code. If ntpd was configured to use public key cryptography\nfor NTP packet authentication, a remote attacker could use this flaw to\nsend a specially-crafted request packet that could crash ntpd or,\npotentially, execute arbitrary code with the privileges of the \"ntp\" user.\n(CVE-2009-1252)\n\nNote: NTP authentication is not enabled by default.\n\nA buffer overflow flaw was found in the ntpq diagnostic command. A\nmalicious, remote server could send a specially-crafted reply to an ntpq\nrequest that could crash ntpq or, potentially, execute arbitrary code with\nthe privileges of the user running the ntpq command. (CVE-2009-0159)\n\nAll ntp users are advised to upgrade to this updated package, which\ncontains backported patches to resolve these issues. After installing the\nupdate, the ntpd daemon will be restarted automatically.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2009:1040",
"url": "https://access.redhat.com/errata/RHSA-2009:1040"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#critical",
"url": "https://access.redhat.com/security/updates/classification/#critical"
},
{
"category": "external",
"summary": "490617",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=490617"
},
{
"category": "external",
"summary": "499694",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=499694"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_1040.json"
}
],
"title": "Red Hat Security Advisory: ntp security update",
"tracking": {
"current_release_date": "2024-11-22T03:08:08+00:00",
"generator": {
"date": "2024-11-22T03:08:08+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2009:1040",
"initial_release_date": "2009-05-18T20:51:00+00:00",
"revision_history": [
{
"date": "2009-05-18T20:51:00+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2009-05-18T16:53:21+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-22T03:08:08+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AS version 4",
"product": {
"name": "Red Hat Enterprise Linux AS version 4",
"product_id": "4AS",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:4::as"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Desktop version 4",
"product": {
"name": "Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:4::desktop"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux ES version 4",
"product": {
"name": "Red Hat Enterprise Linux ES version 4",
"product_id": "4ES",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:4::es"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux WS version 4",
"product": {
"name": "Red Hat Enterprise Linux WS version 4",
"product_id": "4WS",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:4::ws"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AS EUS (v. 4.7)",
"product": {
"name": "Red Hat Enterprise Linux AS EUS (v. 4.7)",
"product_id": "4AS-4.7.z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:rhel_eus:4.7::as"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux ES EUS (v. 4.7)",
"product": {
"name": "Red Hat Enterprise Linux ES EUS (v. 4.7)",
"product_id": "4ES-4.7.z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:rhel_eus:4.7::es"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"product": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"product_id": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp@4.2.0.a.20040617-8.el4_7.2?arch=ia64"
}
}
},
{
"category": "product_version",
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"product": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"product_id": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp-debuginfo@4.2.0.a.20040617-8.el4_7.2?arch=ia64"
}
}
}
],
"category": "architecture",
"name": "ia64"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"product": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"product_id": "ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp@4.2.0.a.20040617-8.el4_7.2?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"product": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"product_id": "ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp@4.2.0.a.20040617-8.el4_7.2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"product": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"product_id": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp-debuginfo@4.2.0.a.20040617-8.el4_7.2?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"product": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"product_id": "ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp@4.2.0.a.20040617-8.el4_7.2?arch=i386"
}
}
},
{
"category": "product_version",
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"product": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"product_id": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp-debuginfo@4.2.0.a.20040617-8.el4_7.2?arch=i386"
}
}
}
],
"category": "architecture",
"name": "i386"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"product": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"product_id": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp@4.2.0.a.20040617-8.el4_7.2?arch=ppc"
}
}
},
{
"category": "product_version",
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"product": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"product_id": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp-debuginfo@4.2.0.a.20040617-8.el4_7.2?arch=ppc"
}
}
}
],
"category": "architecture",
"name": "ppc"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"product": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"product_id": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp@4.2.0.a.20040617-8.el4_7.2?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"product": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"product_id": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp-debuginfo@4.2.0.a.20040617-8.el4_7.2?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"product": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"product_id": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp@4.2.0.a.20040617-8.el4_7.2?arch=s390"
}
}
},
{
"category": "product_version",
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"product": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"product_id": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp-debuginfo@4.2.0.a.20040617-8.el4_7.2?arch=s390"
}
}
}
],
"category": "architecture",
"name": "s390"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.i386 as a component of Red Hat Enterprise Linux AS EUS (v. 4.7)",
"product_id": "4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"relates_to_product_reference": "4AS-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64 as a component of Red Hat Enterprise Linux AS EUS (v. 4.7)",
"product_id": "4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"relates_to_product_reference": "4AS-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc as a component of Red Hat Enterprise Linux AS EUS (v. 4.7)",
"product_id": "4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"relates_to_product_reference": "4AS-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390 as a component of Red Hat Enterprise Linux AS EUS (v. 4.7)",
"product_id": "4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"relates_to_product_reference": "4AS-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x as a component of Red Hat Enterprise Linux AS EUS (v. 4.7)",
"product_id": "4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"relates_to_product_reference": "4AS-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.src as a component of Red Hat Enterprise Linux AS EUS (v. 4.7)",
"product_id": "4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.src"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"relates_to_product_reference": "4AS-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64 as a component of Red Hat Enterprise Linux AS EUS (v. 4.7)",
"product_id": "4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"relates_to_product_reference": "4AS-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386 as a component of Red Hat Enterprise Linux AS EUS (v. 4.7)",
"product_id": "4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"relates_to_product_reference": "4AS-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64 as a component of Red Hat Enterprise Linux AS EUS (v. 4.7)",
"product_id": "4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"relates_to_product_reference": "4AS-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc as a component of Red Hat Enterprise Linux AS EUS (v. 4.7)",
"product_id": "4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"relates_to_product_reference": "4AS-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390 as a component of Red Hat Enterprise Linux AS EUS (v. 4.7)",
"product_id": "4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"relates_to_product_reference": "4AS-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x as a component of Red Hat Enterprise Linux AS EUS (v. 4.7)",
"product_id": "4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"relates_to_product_reference": "4AS-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64 as a component of Red Hat Enterprise Linux AS EUS (v. 4.7)",
"product_id": "4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"relates_to_product_reference": "4AS-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.i386 as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64 as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390 as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.src as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.src"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64 as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386 as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64 as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390 as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64 as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.i386 as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64 as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390 as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.src as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.src"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64 as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386 as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64 as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390 as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64 as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.i386 as a component of Red Hat Enterprise Linux ES EUS (v. 4.7)",
"product_id": "4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"relates_to_product_reference": "4ES-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64 as a component of Red Hat Enterprise Linux ES EUS (v. 4.7)",
"product_id": "4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"relates_to_product_reference": "4ES-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc as a component of Red Hat Enterprise Linux ES EUS (v. 4.7)",
"product_id": "4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"relates_to_product_reference": "4ES-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390 as a component of Red Hat Enterprise Linux ES EUS (v. 4.7)",
"product_id": "4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"relates_to_product_reference": "4ES-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x as a component of Red Hat Enterprise Linux ES EUS (v. 4.7)",
"product_id": "4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"relates_to_product_reference": "4ES-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.src as a component of Red Hat Enterprise Linux ES EUS (v. 4.7)",
"product_id": "4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.src"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"relates_to_product_reference": "4ES-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64 as a component of Red Hat Enterprise Linux ES EUS (v. 4.7)",
"product_id": "4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"relates_to_product_reference": "4ES-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386 as a component of Red Hat Enterprise Linux ES EUS (v. 4.7)",
"product_id": "4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"relates_to_product_reference": "4ES-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64 as a component of Red Hat Enterprise Linux ES EUS (v. 4.7)",
"product_id": "4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"relates_to_product_reference": "4ES-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc as a component of Red Hat Enterprise Linux ES EUS (v. 4.7)",
"product_id": "4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"relates_to_product_reference": "4ES-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390 as a component of Red Hat Enterprise Linux ES EUS (v. 4.7)",
"product_id": "4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"relates_to_product_reference": "4ES-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x as a component of Red Hat Enterprise Linux ES EUS (v. 4.7)",
"product_id": "4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"relates_to_product_reference": "4ES-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64 as a component of Red Hat Enterprise Linux ES EUS (v. 4.7)",
"product_id": "4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"relates_to_product_reference": "4ES-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.i386 as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64 as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390 as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.src as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.src"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64 as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386 as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64 as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390 as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64 as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.i386 as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"relates_to_product_reference": "4WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64 as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"relates_to_product_reference": "4WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"relates_to_product_reference": "4WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390 as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"relates_to_product_reference": "4WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"relates_to_product_reference": "4WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.src as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.src"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"relates_to_product_reference": "4WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64 as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"relates_to_product_reference": "4WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386 as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"relates_to_product_reference": "4WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64 as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"relates_to_product_reference": "4WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"relates_to_product_reference": "4WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390 as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"relates_to_product_reference": "4WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"relates_to_product_reference": "4WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64 as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"relates_to_product_reference": "4WS"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2009-0159",
"cwe": {
"id": "CWE-121",
"name": "Stack-based Buffer Overflow"
},
"discovery_date": "2009-03-12T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "490617"
}
],
"notes": [
{
"category": "description",
"text": "Stack-based buffer overflow in the cookedprint function in ntpq/ntpq.c in ntpq in NTP before 4.2.4p7-RC2 allows remote NTP servers to execute arbitrary code via a crafted response.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ntp: buffer overflow in ntpq",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2009-0159"
},
{
"category": "external",
"summary": "RHBZ#490617",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=490617"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2009-0159",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0159"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-0159",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2009-0159"
}
],
"release_date": "2009-04-09T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2009-05-18T20:51:00+00:00",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2009:1040"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "ntp: buffer overflow in ntpq"
},
{
"cve": "CVE-2009-1252",
"cwe": {
"id": "CWE-121",
"name": "Stack-based Buffer Overflow"
},
"discovery_date": "2009-05-06T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "499694"
}
],
"notes": [
{
"category": "description",
"text": "Stack-based buffer overflow in the crypto_recv function in ntp_crypto.c in ntpd in NTP before 4.2.4p7 and 4.2.5 before 4.2.5p74, when OpenSSL and autokey are enabled, allows remote attackers to execute arbitrary code via a crafted packet containing an extension field.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ntp: remote arbitrary code execution vulnerability if autokeys is enabled",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2009-1252"
},
{
"category": "external",
"summary": "RHBZ#499694",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=499694"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2009-1252",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-1252"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-1252",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2009-1252"
}
],
"release_date": "2009-05-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2009-05-18T20:51:00+00:00",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2009:1040"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "ntp: remote arbitrary code execution vulnerability if autokeys is enabled"
}
]
}
RHSA-2009:1039
Vulnerability from csaf_redhat
Published
2009-05-18 20:33
Modified
2025-10-09 13:17
Summary
Red Hat Security Advisory: ntp security update
Notes
Topic
An updated ntp package that fixes two security issues is now available for
Red Hat Enterprise Linux 5.
This update has been rated as having important security impact by the Red
Hat Security Response Team.
Details
The Network Time Protocol (NTP) is used to synchronize a computer's time
with a referenced time source.
A buffer overflow flaw was discovered in the ntpd daemon's NTPv4
authentication code. If ntpd was configured to use public key cryptography
for NTP packet authentication, a remote attacker could use this flaw to
send a specially-crafted request packet that could crash ntpd.
(CVE-2009-1252)
Note: NTP authentication is not enabled by default.
A buffer overflow flaw was found in the ntpq diagnostic command. A
malicious, remote server could send a specially-crafted reply to an ntpq
request that could crash ntpq. (CVE-2009-0159)
All ntp users are advised to upgrade to this updated package, which
contains backported patches to resolve these issues. After installing the
update, the ntpd daemon will be restarted automatically.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An updated ntp package that fixes two security issues is now available for\nRed Hat Enterprise Linux 5.\n\nThis update has been rated as having important security impact by the Red\nHat Security Response Team.",
"title": "Topic"
},
{
"category": "general",
"text": "The Network Time Protocol (NTP) is used to synchronize a computer\u0027s time\nwith a referenced time source.\n\nA buffer overflow flaw was discovered in the ntpd daemon\u0027s NTPv4\nauthentication code. If ntpd was configured to use public key cryptography\nfor NTP packet authentication, a remote attacker could use this flaw to\nsend a specially-crafted request packet that could crash ntpd.\n(CVE-2009-1252)\n\nNote: NTP authentication is not enabled by default.\n\nA buffer overflow flaw was found in the ntpq diagnostic command. A\nmalicious, remote server could send a specially-crafted reply to an ntpq\nrequest that could crash ntpq. (CVE-2009-0159)\n\nAll ntp users are advised to upgrade to this updated package, which\ncontains backported patches to resolve these issues. After installing the\nupdate, the ntpd daemon will be restarted automatically.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2009:1039",
"url": "https://access.redhat.com/errata/RHSA-2009:1039"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "490617",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=490617"
},
{
"category": "external",
"summary": "499694",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=499694"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_1039.json"
}
],
"title": "Red Hat Security Advisory: ntp security update",
"tracking": {
"current_release_date": "2025-10-09T13:17:03+00:00",
"generator": {
"date": "2025-10-09T13:17:03+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.9"
}
},
"id": "RHSA-2009:1039",
"initial_release_date": "2009-05-18T20:33:00+00:00",
"revision_history": [
{
"date": "2009-05-18T20:33:00+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2009-05-18T16:35:07+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-10-09T13:17:03+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Desktop (v. 5 client)",
"product": {
"name": "Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:5::client"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux (v. 5 server)",
"product": {
"name": "Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:5::server"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-0:4.2.2p1-9.el5_3.2.src",
"product": {
"name": "ntp-0:4.2.2p1-9.el5_3.2.src",
"product_id": "ntp-0:4.2.2p1-9.el5_3.2.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp@4.2.2p1-9.el5_3.2?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-0:4.2.2p1-9.el5_3.2.x86_64",
"product": {
"name": "ntp-0:4.2.2p1-9.el5_3.2.x86_64",
"product_id": "ntp-0:4.2.2p1-9.el5_3.2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp@4.2.2p1-9.el5_3.2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.x86_64",
"product": {
"name": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.x86_64",
"product_id": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp-debuginfo@4.2.2p1-9.el5_3.2?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-0:4.2.2p1-9.el5_3.2.i386",
"product": {
"name": "ntp-0:4.2.2p1-9.el5_3.2.i386",
"product_id": "ntp-0:4.2.2p1-9.el5_3.2.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp@4.2.2p1-9.el5_3.2?arch=i386"
}
}
},
{
"category": "product_version",
"name": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.i386",
"product": {
"name": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.i386",
"product_id": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp-debuginfo@4.2.2p1-9.el5_3.2?arch=i386"
}
}
}
],
"category": "architecture",
"name": "i386"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-0:4.2.2p1-9.el5_3.2.ia64",
"product": {
"name": "ntp-0:4.2.2p1-9.el5_3.2.ia64",
"product_id": "ntp-0:4.2.2p1-9.el5_3.2.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp@4.2.2p1-9.el5_3.2?arch=ia64"
}
}
},
{
"category": "product_version",
"name": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ia64",
"product": {
"name": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ia64",
"product_id": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp-debuginfo@4.2.2p1-9.el5_3.2?arch=ia64"
}
}
}
],
"category": "architecture",
"name": "ia64"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-0:4.2.2p1-9.el5_3.2.ppc",
"product": {
"name": "ntp-0:4.2.2p1-9.el5_3.2.ppc",
"product_id": "ntp-0:4.2.2p1-9.el5_3.2.ppc",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp@4.2.2p1-9.el5_3.2?arch=ppc"
}
}
},
{
"category": "product_version",
"name": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ppc",
"product": {
"name": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ppc",
"product_id": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ppc",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp-debuginfo@4.2.2p1-9.el5_3.2?arch=ppc"
}
}
}
],
"category": "architecture",
"name": "ppc"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-0:4.2.2p1-9.el5_3.2.s390x",
"product": {
"name": "ntp-0:4.2.2p1-9.el5_3.2.s390x",
"product_id": "ntp-0:4.2.2p1-9.el5_3.2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp@4.2.2p1-9.el5_3.2?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.s390x",
"product": {
"name": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.s390x",
"product_id": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp-debuginfo@4.2.2p1-9.el5_3.2?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.2p1-9.el5_3.2.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client:ntp-0:4.2.2p1-9.el5_3.2.i386"
},
"product_reference": "ntp-0:4.2.2p1-9.el5_3.2.i386",
"relates_to_product_reference": "5Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.2p1-9.el5_3.2.ia64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client:ntp-0:4.2.2p1-9.el5_3.2.ia64"
},
"product_reference": "ntp-0:4.2.2p1-9.el5_3.2.ia64",
"relates_to_product_reference": "5Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.2p1-9.el5_3.2.ppc as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client:ntp-0:4.2.2p1-9.el5_3.2.ppc"
},
"product_reference": "ntp-0:4.2.2p1-9.el5_3.2.ppc",
"relates_to_product_reference": "5Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.2p1-9.el5_3.2.s390x as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client:ntp-0:4.2.2p1-9.el5_3.2.s390x"
},
"product_reference": "ntp-0:4.2.2p1-9.el5_3.2.s390x",
"relates_to_product_reference": "5Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.2p1-9.el5_3.2.src as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client:ntp-0:4.2.2p1-9.el5_3.2.src"
},
"product_reference": "ntp-0:4.2.2p1-9.el5_3.2.src",
"relates_to_product_reference": "5Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.2p1-9.el5_3.2.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client:ntp-0:4.2.2p1-9.el5_3.2.x86_64"
},
"product_reference": "ntp-0:4.2.2p1-9.el5_3.2.x86_64",
"relates_to_product_reference": "5Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.i386"
},
"product_reference": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.i386",
"relates_to_product_reference": "5Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ia64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ia64"
},
"product_reference": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ia64",
"relates_to_product_reference": "5Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ppc as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ppc"
},
"product_reference": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ppc",
"relates_to_product_reference": "5Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.s390x as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.s390x"
},
"product_reference": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.s390x",
"relates_to_product_reference": "5Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.x86_64"
},
"product_reference": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.x86_64",
"relates_to_product_reference": "5Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.2p1-9.el5_3.2.i386 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:ntp-0:4.2.2p1-9.el5_3.2.i386"
},
"product_reference": "ntp-0:4.2.2p1-9.el5_3.2.i386",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.2p1-9.el5_3.2.ia64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:ntp-0:4.2.2p1-9.el5_3.2.ia64"
},
"product_reference": "ntp-0:4.2.2p1-9.el5_3.2.ia64",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.2p1-9.el5_3.2.ppc as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:ntp-0:4.2.2p1-9.el5_3.2.ppc"
},
"product_reference": "ntp-0:4.2.2p1-9.el5_3.2.ppc",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.2p1-9.el5_3.2.s390x as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:ntp-0:4.2.2p1-9.el5_3.2.s390x"
},
"product_reference": "ntp-0:4.2.2p1-9.el5_3.2.s390x",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.2p1-9.el5_3.2.src as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:ntp-0:4.2.2p1-9.el5_3.2.src"
},
"product_reference": "ntp-0:4.2.2p1-9.el5_3.2.src",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.2p1-9.el5_3.2.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:ntp-0:4.2.2p1-9.el5_3.2.x86_64"
},
"product_reference": "ntp-0:4.2.2p1-9.el5_3.2.x86_64",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.i386 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.i386"
},
"product_reference": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.i386",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ia64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ia64"
},
"product_reference": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ia64",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ppc as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ppc"
},
"product_reference": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ppc",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.s390x as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.s390x"
},
"product_reference": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.s390x",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.x86_64"
},
"product_reference": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.x86_64",
"relates_to_product_reference": "5Server"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2009-0159",
"cwe": {
"id": "CWE-121",
"name": "Stack-based Buffer Overflow"
},
"discovery_date": "2009-03-12T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "490617"
}
],
"notes": [
{
"category": "description",
"text": "Stack-based buffer overflow in the cookedprint function in ntpq/ntpq.c in ntpq in NTP before 4.2.4p7-RC2 allows remote NTP servers to execute arbitrary code via a crafted response.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ntp: buffer overflow in ntpq",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Client:ntp-0:4.2.2p1-9.el5_3.2.i386",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.ia64",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.ppc",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.s390x",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.src",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.x86_64",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.i386",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ia64",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ppc",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.s390x",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.x86_64",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.i386",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.ia64",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.ppc",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.s390x",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.src",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.x86_64",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.i386",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ia64",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ppc",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.s390x",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2009-0159"
},
{
"category": "external",
"summary": "RHBZ#490617",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=490617"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2009-0159",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0159"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-0159",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2009-0159"
}
],
"release_date": "2009-04-09T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2009-05-18T20:33:00+00:00",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"5Client:ntp-0:4.2.2p1-9.el5_3.2.i386",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.ia64",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.ppc",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.s390x",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.src",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.x86_64",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.i386",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ia64",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ppc",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.s390x",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.x86_64",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.i386",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.ia64",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.ppc",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.s390x",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.src",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.x86_64",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.i386",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ia64",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ppc",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.s390x",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2009:1039"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"5Client:ntp-0:4.2.2p1-9.el5_3.2.i386",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.ia64",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.ppc",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.s390x",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.src",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.x86_64",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.i386",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ia64",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ppc",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.s390x",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.x86_64",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.i386",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.ia64",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.ppc",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.s390x",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.src",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.x86_64",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.i386",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ia64",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ppc",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.s390x",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "ntp: buffer overflow in ntpq"
},
{
"cve": "CVE-2009-1252",
"cwe": {
"id": "CWE-121",
"name": "Stack-based Buffer Overflow"
},
"discovery_date": "2009-05-06T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "499694"
}
],
"notes": [
{
"category": "description",
"text": "Stack-based buffer overflow in the crypto_recv function in ntp_crypto.c in ntpd in NTP before 4.2.4p7 and 4.2.5 before 4.2.5p74, when OpenSSL and autokey are enabled, allows remote attackers to execute arbitrary code via a crafted packet containing an extension field.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ntp: remote arbitrary code execution vulnerability if autokeys is enabled",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Client:ntp-0:4.2.2p1-9.el5_3.2.i386",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.ia64",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.ppc",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.s390x",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.src",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.x86_64",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.i386",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ia64",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ppc",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.s390x",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.x86_64",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.i386",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.ia64",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.ppc",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.s390x",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.src",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.x86_64",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.i386",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ia64",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ppc",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.s390x",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2009-1252"
},
{
"category": "external",
"summary": "RHBZ#499694",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=499694"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2009-1252",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-1252"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-1252",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2009-1252"
}
],
"release_date": "2009-05-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2009-05-18T20:33:00+00:00",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"5Client:ntp-0:4.2.2p1-9.el5_3.2.i386",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.ia64",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.ppc",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.s390x",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.src",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.x86_64",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.i386",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ia64",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ppc",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.s390x",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.x86_64",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.i386",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.ia64",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.ppc",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.s390x",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.src",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.x86_64",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.i386",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ia64",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ppc",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.s390x",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2009:1039"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"5Client:ntp-0:4.2.2p1-9.el5_3.2.i386",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.ia64",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.ppc",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.s390x",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.src",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.x86_64",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.i386",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ia64",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ppc",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.s390x",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.x86_64",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.i386",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.ia64",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.ppc",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.s390x",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.src",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.x86_64",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.i386",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ia64",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ppc",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.s390x",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "ntp: remote arbitrary code execution vulnerability if autokeys is enabled"
}
]
}
RHSA-2009:1651
Vulnerability from csaf_redhat
Published
2009-12-08 19:42
Modified
2025-10-09 13:19
Summary
Red Hat Security Advisory: ntp security update
Notes
Topic
An updated ntp package that fixes two security issues is now available for
Red Hat Enterprise Linux 3.
This update has been rated as having moderate security impact by the Red
Hat Security Response Team.
Details
The Network Time Protocol (NTP) is used to synchronize a computer's time
with a referenced time source.
Robin Park and Dmitri Vinokurov discovered a flaw in the way ntpd handled
certain malformed NTP packets. ntpd logged information about all such
packets and replied with an NTP packet that was treated as malformed when
received by another ntpd. A remote attacker could use this flaw to create
an NTP packet reply loop between two ntpd servers via a malformed packet
with a spoofed source IP address and port, causing ntpd on those servers to
use excessive amounts of CPU time and fill disk space with log messages.
(CVE-2009-3563)
A buffer overflow flaw was found in the ntpq diagnostic command. A
malicious, remote server could send a specially-crafted reply to an ntpq
request that could crash ntpq or, potentially, execute arbitrary code with
the privileges of the user running the ntpq command. (CVE-2009-0159)
All ntp users are advised to upgrade to this updated package, which
contains backported patches to resolve these issues. After installing the
update, the ntpd daemon will restart automatically.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An updated ntp package that fixes two security issues is now available for\nRed Hat Enterprise Linux 3.\n\nThis update has been rated as having moderate security impact by the Red\nHat Security Response Team.",
"title": "Topic"
},
{
"category": "general",
"text": "The Network Time Protocol (NTP) is used to synchronize a computer\u0027s time\nwith a referenced time source.\n\nRobin Park and Dmitri Vinokurov discovered a flaw in the way ntpd handled\ncertain malformed NTP packets. ntpd logged information about all such\npackets and replied with an NTP packet that was treated as malformed when\nreceived by another ntpd. A remote attacker could use this flaw to create\nan NTP packet reply loop between two ntpd servers via a malformed packet\nwith a spoofed source IP address and port, causing ntpd on those servers to\nuse excessive amounts of CPU time and fill disk space with log messages.\n(CVE-2009-3563)\n\nA buffer overflow flaw was found in the ntpq diagnostic command. A\nmalicious, remote server could send a specially-crafted reply to an ntpq\nrequest that could crash ntpq or, potentially, execute arbitrary code with\nthe privileges of the user running the ntpq command. (CVE-2009-0159)\n\nAll ntp users are advised to upgrade to this updated package, which\ncontains backported patches to resolve these issues. After installing the\nupdate, the ntpd daemon will restart automatically.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2009:1651",
"url": "https://access.redhat.com/errata/RHSA-2009:1651"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "490617",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=490617"
},
{
"category": "external",
"summary": "531213",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=531213"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_1651.json"
}
],
"title": "Red Hat Security Advisory: ntp security update",
"tracking": {
"current_release_date": "2025-10-09T13:19:04+00:00",
"generator": {
"date": "2025-10-09T13:19:04+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.9"
}
},
"id": "RHSA-2009:1651",
"initial_release_date": "2009-12-08T19:42:00+00:00",
"revision_history": [
{
"date": "2009-12-08T19:42:00+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2009-12-08T14:50:43+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-10-09T13:19:04+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AS version 3",
"product": {
"name": "Red Hat Enterprise Linux AS version 3",
"product_id": "3AS",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:3::as"
}
}
},
{
"category": "product_name",
"name": "Red Hat Desktop version 3",
"product": {
"name": "Red Hat Desktop version 3",
"product_id": "3Desktop",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:3::desktop"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux ES version 3",
"product": {
"name": "Red Hat Enterprise Linux ES version 3",
"product_id": "3ES",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:3::es"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux WS version 3",
"product": {
"name": "Red Hat Enterprise Linux WS version 3",
"product_id": "3WS",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:3::ws"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-debuginfo-0:4.1.2-6.el3.ia64",
"product": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.ia64",
"product_id": "ntp-debuginfo-0:4.1.2-6.el3.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp-debuginfo@4.1.2-6.el3?arch=ia64"
}
}
},
{
"category": "product_version",
"name": "ntp-0:4.1.2-6.el3.ia64",
"product": {
"name": "ntp-0:4.1.2-6.el3.ia64",
"product_id": "ntp-0:4.1.2-6.el3.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp@4.1.2-6.el3?arch=ia64"
}
}
}
],
"category": "architecture",
"name": "ia64"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"product": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"product_id": "ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp-debuginfo@4.1.2-6.el3?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "ntp-0:4.1.2-6.el3.x86_64",
"product": {
"name": "ntp-0:4.1.2-6.el3.x86_64",
"product_id": "ntp-0:4.1.2-6.el3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp@4.1.2-6.el3?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-debuginfo-0:4.1.2-6.el3.i386",
"product": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.i386",
"product_id": "ntp-debuginfo-0:4.1.2-6.el3.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp-debuginfo@4.1.2-6.el3?arch=i386"
}
}
},
{
"category": "product_version",
"name": "ntp-0:4.1.2-6.el3.i386",
"product": {
"name": "ntp-0:4.1.2-6.el3.i386",
"product_id": "ntp-0:4.1.2-6.el3.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp@4.1.2-6.el3?arch=i386"
}
}
}
],
"category": "architecture",
"name": "i386"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-0:4.1.2-6.el3.src",
"product": {
"name": "ntp-0:4.1.2-6.el3.src",
"product_id": "ntp-0:4.1.2-6.el3.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp@4.1.2-6.el3?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-debuginfo-0:4.1.2-6.el3.ppc",
"product": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.ppc",
"product_id": "ntp-debuginfo-0:4.1.2-6.el3.ppc",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp-debuginfo@4.1.2-6.el3?arch=ppc"
}
}
},
{
"category": "product_version",
"name": "ntp-0:4.1.2-6.el3.ppc",
"product": {
"name": "ntp-0:4.1.2-6.el3.ppc",
"product_id": "ntp-0:4.1.2-6.el3.ppc",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp@4.1.2-6.el3?arch=ppc"
}
}
}
],
"category": "architecture",
"name": "ppc"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-debuginfo-0:4.1.2-6.el3.s390x",
"product": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.s390x",
"product_id": "ntp-debuginfo-0:4.1.2-6.el3.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp-debuginfo@4.1.2-6.el3?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "ntp-0:4.1.2-6.el3.s390x",
"product": {
"name": "ntp-0:4.1.2-6.el3.s390x",
"product_id": "ntp-0:4.1.2-6.el3.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp@4.1.2-6.el3?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-debuginfo-0:4.1.2-6.el3.s390",
"product": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.s390",
"product_id": "ntp-debuginfo-0:4.1.2-6.el3.s390",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp-debuginfo@4.1.2-6.el3?arch=s390"
}
}
},
{
"category": "product_version",
"name": "ntp-0:4.1.2-6.el3.s390",
"product": {
"name": "ntp-0:4.1.2-6.el3.s390",
"product_id": "ntp-0:4.1.2-6.el3.s390",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp@4.1.2-6.el3?arch=s390"
}
}
}
],
"category": "architecture",
"name": "s390"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.i386 as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:ntp-0:4.1.2-6.el3.i386"
},
"product_reference": "ntp-0:4.1.2-6.el3.i386",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.ia64 as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:ntp-0:4.1.2-6.el3.ia64"
},
"product_reference": "ntp-0:4.1.2-6.el3.ia64",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.ppc as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:ntp-0:4.1.2-6.el3.ppc"
},
"product_reference": "ntp-0:4.1.2-6.el3.ppc",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.s390 as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:ntp-0:4.1.2-6.el3.s390"
},
"product_reference": "ntp-0:4.1.2-6.el3.s390",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.s390x as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:ntp-0:4.1.2-6.el3.s390x"
},
"product_reference": "ntp-0:4.1.2-6.el3.s390x",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.src as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:ntp-0:4.1.2-6.el3.src"
},
"product_reference": "ntp-0:4.1.2-6.el3.src",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.x86_64 as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:ntp-0:4.1.2-6.el3.x86_64"
},
"product_reference": "ntp-0:4.1.2-6.el3.x86_64",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.i386 as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:ntp-debuginfo-0:4.1.2-6.el3.i386"
},
"product_reference": "ntp-debuginfo-0:4.1.2-6.el3.i386",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.ia64 as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:ntp-debuginfo-0:4.1.2-6.el3.ia64"
},
"product_reference": "ntp-debuginfo-0:4.1.2-6.el3.ia64",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.ppc as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:ntp-debuginfo-0:4.1.2-6.el3.ppc"
},
"product_reference": "ntp-debuginfo-0:4.1.2-6.el3.ppc",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.s390 as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:ntp-debuginfo-0:4.1.2-6.el3.s390"
},
"product_reference": "ntp-debuginfo-0:4.1.2-6.el3.s390",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.s390x as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:ntp-debuginfo-0:4.1.2-6.el3.s390x"
},
"product_reference": "ntp-debuginfo-0:4.1.2-6.el3.s390x",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.x86_64 as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:ntp-debuginfo-0:4.1.2-6.el3.x86_64"
},
"product_reference": "ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.i386 as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:ntp-0:4.1.2-6.el3.i386"
},
"product_reference": "ntp-0:4.1.2-6.el3.i386",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.ia64 as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:ntp-0:4.1.2-6.el3.ia64"
},
"product_reference": "ntp-0:4.1.2-6.el3.ia64",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.ppc as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:ntp-0:4.1.2-6.el3.ppc"
},
"product_reference": "ntp-0:4.1.2-6.el3.ppc",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.s390 as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:ntp-0:4.1.2-6.el3.s390"
},
"product_reference": "ntp-0:4.1.2-6.el3.s390",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.s390x as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:ntp-0:4.1.2-6.el3.s390x"
},
"product_reference": "ntp-0:4.1.2-6.el3.s390x",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.src as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:ntp-0:4.1.2-6.el3.src"
},
"product_reference": "ntp-0:4.1.2-6.el3.src",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.x86_64 as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:ntp-0:4.1.2-6.el3.x86_64"
},
"product_reference": "ntp-0:4.1.2-6.el3.x86_64",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.i386 as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:ntp-debuginfo-0:4.1.2-6.el3.i386"
},
"product_reference": "ntp-debuginfo-0:4.1.2-6.el3.i386",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.ia64 as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:ntp-debuginfo-0:4.1.2-6.el3.ia64"
},
"product_reference": "ntp-debuginfo-0:4.1.2-6.el3.ia64",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.ppc as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:ntp-debuginfo-0:4.1.2-6.el3.ppc"
},
"product_reference": "ntp-debuginfo-0:4.1.2-6.el3.ppc",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.s390 as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:ntp-debuginfo-0:4.1.2-6.el3.s390"
},
"product_reference": "ntp-debuginfo-0:4.1.2-6.el3.s390",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.s390x as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:ntp-debuginfo-0:4.1.2-6.el3.s390x"
},
"product_reference": "ntp-debuginfo-0:4.1.2-6.el3.s390x",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.x86_64 as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:ntp-debuginfo-0:4.1.2-6.el3.x86_64"
},
"product_reference": "ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.i386 as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:ntp-0:4.1.2-6.el3.i386"
},
"product_reference": "ntp-0:4.1.2-6.el3.i386",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.ia64 as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:ntp-0:4.1.2-6.el3.ia64"
},
"product_reference": "ntp-0:4.1.2-6.el3.ia64",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.ppc as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:ntp-0:4.1.2-6.el3.ppc"
},
"product_reference": "ntp-0:4.1.2-6.el3.ppc",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.s390 as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:ntp-0:4.1.2-6.el3.s390"
},
"product_reference": "ntp-0:4.1.2-6.el3.s390",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.s390x as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:ntp-0:4.1.2-6.el3.s390x"
},
"product_reference": "ntp-0:4.1.2-6.el3.s390x",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.src as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:ntp-0:4.1.2-6.el3.src"
},
"product_reference": "ntp-0:4.1.2-6.el3.src",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.x86_64 as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:ntp-0:4.1.2-6.el3.x86_64"
},
"product_reference": "ntp-0:4.1.2-6.el3.x86_64",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.i386 as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:ntp-debuginfo-0:4.1.2-6.el3.i386"
},
"product_reference": "ntp-debuginfo-0:4.1.2-6.el3.i386",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.ia64 as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:ntp-debuginfo-0:4.1.2-6.el3.ia64"
},
"product_reference": "ntp-debuginfo-0:4.1.2-6.el3.ia64",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.ppc as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:ntp-debuginfo-0:4.1.2-6.el3.ppc"
},
"product_reference": "ntp-debuginfo-0:4.1.2-6.el3.ppc",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.s390 as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:ntp-debuginfo-0:4.1.2-6.el3.s390"
},
"product_reference": "ntp-debuginfo-0:4.1.2-6.el3.s390",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.s390x as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:ntp-debuginfo-0:4.1.2-6.el3.s390x"
},
"product_reference": "ntp-debuginfo-0:4.1.2-6.el3.s390x",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.x86_64 as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:ntp-debuginfo-0:4.1.2-6.el3.x86_64"
},
"product_reference": "ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.i386 as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:ntp-0:4.1.2-6.el3.i386"
},
"product_reference": "ntp-0:4.1.2-6.el3.i386",
"relates_to_product_reference": "3WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.ia64 as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:ntp-0:4.1.2-6.el3.ia64"
},
"product_reference": "ntp-0:4.1.2-6.el3.ia64",
"relates_to_product_reference": "3WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.ppc as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:ntp-0:4.1.2-6.el3.ppc"
},
"product_reference": "ntp-0:4.1.2-6.el3.ppc",
"relates_to_product_reference": "3WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.s390 as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:ntp-0:4.1.2-6.el3.s390"
},
"product_reference": "ntp-0:4.1.2-6.el3.s390",
"relates_to_product_reference": "3WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.s390x as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:ntp-0:4.1.2-6.el3.s390x"
},
"product_reference": "ntp-0:4.1.2-6.el3.s390x",
"relates_to_product_reference": "3WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.src as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:ntp-0:4.1.2-6.el3.src"
},
"product_reference": "ntp-0:4.1.2-6.el3.src",
"relates_to_product_reference": "3WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.1.2-6.el3.x86_64 as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:ntp-0:4.1.2-6.el3.x86_64"
},
"product_reference": "ntp-0:4.1.2-6.el3.x86_64",
"relates_to_product_reference": "3WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.i386 as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:ntp-debuginfo-0:4.1.2-6.el3.i386"
},
"product_reference": "ntp-debuginfo-0:4.1.2-6.el3.i386",
"relates_to_product_reference": "3WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.ia64 as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:ntp-debuginfo-0:4.1.2-6.el3.ia64"
},
"product_reference": "ntp-debuginfo-0:4.1.2-6.el3.ia64",
"relates_to_product_reference": "3WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.ppc as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:ntp-debuginfo-0:4.1.2-6.el3.ppc"
},
"product_reference": "ntp-debuginfo-0:4.1.2-6.el3.ppc",
"relates_to_product_reference": "3WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.s390 as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:ntp-debuginfo-0:4.1.2-6.el3.s390"
},
"product_reference": "ntp-debuginfo-0:4.1.2-6.el3.s390",
"relates_to_product_reference": "3WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.s390x as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:ntp-debuginfo-0:4.1.2-6.el3.s390x"
},
"product_reference": "ntp-debuginfo-0:4.1.2-6.el3.s390x",
"relates_to_product_reference": "3WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.1.2-6.el3.x86_64 as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:ntp-debuginfo-0:4.1.2-6.el3.x86_64"
},
"product_reference": "ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"relates_to_product_reference": "3WS"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2009-0159",
"cwe": {
"id": "CWE-121",
"name": "Stack-based Buffer Overflow"
},
"discovery_date": "2009-03-12T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "490617"
}
],
"notes": [
{
"category": "description",
"text": "Stack-based buffer overflow in the cookedprint function in ntpq/ntpq.c in ntpq in NTP before 4.2.4p7-RC2 allows remote NTP servers to execute arbitrary code via a crafted response.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ntp: buffer overflow in ntpq",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"3AS:ntp-0:4.1.2-6.el3.i386",
"3AS:ntp-0:4.1.2-6.el3.ia64",
"3AS:ntp-0:4.1.2-6.el3.ppc",
"3AS:ntp-0:4.1.2-6.el3.s390",
"3AS:ntp-0:4.1.2-6.el3.s390x",
"3AS:ntp-0:4.1.2-6.el3.src",
"3AS:ntp-0:4.1.2-6.el3.x86_64",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.i386",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.ia64",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.ppc",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.s390",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.s390x",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"3Desktop:ntp-0:4.1.2-6.el3.i386",
"3Desktop:ntp-0:4.1.2-6.el3.ia64",
"3Desktop:ntp-0:4.1.2-6.el3.ppc",
"3Desktop:ntp-0:4.1.2-6.el3.s390",
"3Desktop:ntp-0:4.1.2-6.el3.s390x",
"3Desktop:ntp-0:4.1.2-6.el3.src",
"3Desktop:ntp-0:4.1.2-6.el3.x86_64",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.i386",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.ia64",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.ppc",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.s390",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.s390x",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"3ES:ntp-0:4.1.2-6.el3.i386",
"3ES:ntp-0:4.1.2-6.el3.ia64",
"3ES:ntp-0:4.1.2-6.el3.ppc",
"3ES:ntp-0:4.1.2-6.el3.s390",
"3ES:ntp-0:4.1.2-6.el3.s390x",
"3ES:ntp-0:4.1.2-6.el3.src",
"3ES:ntp-0:4.1.2-6.el3.x86_64",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.i386",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.ia64",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.ppc",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.s390",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.s390x",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"3WS:ntp-0:4.1.2-6.el3.i386",
"3WS:ntp-0:4.1.2-6.el3.ia64",
"3WS:ntp-0:4.1.2-6.el3.ppc",
"3WS:ntp-0:4.1.2-6.el3.s390",
"3WS:ntp-0:4.1.2-6.el3.s390x",
"3WS:ntp-0:4.1.2-6.el3.src",
"3WS:ntp-0:4.1.2-6.el3.x86_64",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.i386",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.ia64",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.ppc",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.s390",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.s390x",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2009-0159"
},
{
"category": "external",
"summary": "RHBZ#490617",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=490617"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2009-0159",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0159"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-0159",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2009-0159"
}
],
"release_date": "2009-04-09T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2009-12-08T19:42:00+00:00",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"3AS:ntp-0:4.1.2-6.el3.i386",
"3AS:ntp-0:4.1.2-6.el3.ia64",
"3AS:ntp-0:4.1.2-6.el3.ppc",
"3AS:ntp-0:4.1.2-6.el3.s390",
"3AS:ntp-0:4.1.2-6.el3.s390x",
"3AS:ntp-0:4.1.2-6.el3.src",
"3AS:ntp-0:4.1.2-6.el3.x86_64",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.i386",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.ia64",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.ppc",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.s390",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.s390x",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"3Desktop:ntp-0:4.1.2-6.el3.i386",
"3Desktop:ntp-0:4.1.2-6.el3.ia64",
"3Desktop:ntp-0:4.1.2-6.el3.ppc",
"3Desktop:ntp-0:4.1.2-6.el3.s390",
"3Desktop:ntp-0:4.1.2-6.el3.s390x",
"3Desktop:ntp-0:4.1.2-6.el3.src",
"3Desktop:ntp-0:4.1.2-6.el3.x86_64",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.i386",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.ia64",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.ppc",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.s390",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.s390x",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"3ES:ntp-0:4.1.2-6.el3.i386",
"3ES:ntp-0:4.1.2-6.el3.ia64",
"3ES:ntp-0:4.1.2-6.el3.ppc",
"3ES:ntp-0:4.1.2-6.el3.s390",
"3ES:ntp-0:4.1.2-6.el3.s390x",
"3ES:ntp-0:4.1.2-6.el3.src",
"3ES:ntp-0:4.1.2-6.el3.x86_64",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.i386",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.ia64",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.ppc",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.s390",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.s390x",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"3WS:ntp-0:4.1.2-6.el3.i386",
"3WS:ntp-0:4.1.2-6.el3.ia64",
"3WS:ntp-0:4.1.2-6.el3.ppc",
"3WS:ntp-0:4.1.2-6.el3.s390",
"3WS:ntp-0:4.1.2-6.el3.s390x",
"3WS:ntp-0:4.1.2-6.el3.src",
"3WS:ntp-0:4.1.2-6.el3.x86_64",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.i386",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.ia64",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.ppc",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.s390",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.s390x",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2009:1651"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"3AS:ntp-0:4.1.2-6.el3.i386",
"3AS:ntp-0:4.1.2-6.el3.ia64",
"3AS:ntp-0:4.1.2-6.el3.ppc",
"3AS:ntp-0:4.1.2-6.el3.s390",
"3AS:ntp-0:4.1.2-6.el3.s390x",
"3AS:ntp-0:4.1.2-6.el3.src",
"3AS:ntp-0:4.1.2-6.el3.x86_64",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.i386",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.ia64",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.ppc",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.s390",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.s390x",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"3Desktop:ntp-0:4.1.2-6.el3.i386",
"3Desktop:ntp-0:4.1.2-6.el3.ia64",
"3Desktop:ntp-0:4.1.2-6.el3.ppc",
"3Desktop:ntp-0:4.1.2-6.el3.s390",
"3Desktop:ntp-0:4.1.2-6.el3.s390x",
"3Desktop:ntp-0:4.1.2-6.el3.src",
"3Desktop:ntp-0:4.1.2-6.el3.x86_64",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.i386",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.ia64",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.ppc",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.s390",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.s390x",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"3ES:ntp-0:4.1.2-6.el3.i386",
"3ES:ntp-0:4.1.2-6.el3.ia64",
"3ES:ntp-0:4.1.2-6.el3.ppc",
"3ES:ntp-0:4.1.2-6.el3.s390",
"3ES:ntp-0:4.1.2-6.el3.s390x",
"3ES:ntp-0:4.1.2-6.el3.src",
"3ES:ntp-0:4.1.2-6.el3.x86_64",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.i386",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.ia64",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.ppc",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.s390",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.s390x",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"3WS:ntp-0:4.1.2-6.el3.i386",
"3WS:ntp-0:4.1.2-6.el3.ia64",
"3WS:ntp-0:4.1.2-6.el3.ppc",
"3WS:ntp-0:4.1.2-6.el3.s390",
"3WS:ntp-0:4.1.2-6.el3.s390x",
"3WS:ntp-0:4.1.2-6.el3.src",
"3WS:ntp-0:4.1.2-6.el3.x86_64",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.i386",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.ia64",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.ppc",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.s390",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.s390x",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "ntp: buffer overflow in ntpq"
},
{
"cve": "CVE-2009-3563",
"discovery_date": "2009-10-27T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "531213"
}
],
"notes": [
{
"category": "description",
"text": "ntp_request.c in ntpd in NTP before 4.2.4p8, and 4.2.5, allows remote attackers to cause a denial of service (CPU and bandwidth consumption) by using MODE_PRIVATE to send a spoofed (1) request or (2) response packet that triggers a continuous exchange of MODE_PRIVATE error responses between two NTP daemons.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ntpd: DoS with mode 7 packets (VU#568372)",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"3AS:ntp-0:4.1.2-6.el3.i386",
"3AS:ntp-0:4.1.2-6.el3.ia64",
"3AS:ntp-0:4.1.2-6.el3.ppc",
"3AS:ntp-0:4.1.2-6.el3.s390",
"3AS:ntp-0:4.1.2-6.el3.s390x",
"3AS:ntp-0:4.1.2-6.el3.src",
"3AS:ntp-0:4.1.2-6.el3.x86_64",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.i386",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.ia64",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.ppc",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.s390",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.s390x",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"3Desktop:ntp-0:4.1.2-6.el3.i386",
"3Desktop:ntp-0:4.1.2-6.el3.ia64",
"3Desktop:ntp-0:4.1.2-6.el3.ppc",
"3Desktop:ntp-0:4.1.2-6.el3.s390",
"3Desktop:ntp-0:4.1.2-6.el3.s390x",
"3Desktop:ntp-0:4.1.2-6.el3.src",
"3Desktop:ntp-0:4.1.2-6.el3.x86_64",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.i386",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.ia64",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.ppc",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.s390",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.s390x",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"3ES:ntp-0:4.1.2-6.el3.i386",
"3ES:ntp-0:4.1.2-6.el3.ia64",
"3ES:ntp-0:4.1.2-6.el3.ppc",
"3ES:ntp-0:4.1.2-6.el3.s390",
"3ES:ntp-0:4.1.2-6.el3.s390x",
"3ES:ntp-0:4.1.2-6.el3.src",
"3ES:ntp-0:4.1.2-6.el3.x86_64",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.i386",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.ia64",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.ppc",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.s390",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.s390x",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"3WS:ntp-0:4.1.2-6.el3.i386",
"3WS:ntp-0:4.1.2-6.el3.ia64",
"3WS:ntp-0:4.1.2-6.el3.ppc",
"3WS:ntp-0:4.1.2-6.el3.s390",
"3WS:ntp-0:4.1.2-6.el3.s390x",
"3WS:ntp-0:4.1.2-6.el3.src",
"3WS:ntp-0:4.1.2-6.el3.x86_64",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.i386",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.ia64",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.ppc",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.s390",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.s390x",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2009-3563"
},
{
"category": "external",
"summary": "RHBZ#531213",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=531213"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2009-3563",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-3563"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-3563",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2009-3563"
}
],
"release_date": "2009-12-08T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2009-12-08T19:42:00+00:00",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"3AS:ntp-0:4.1.2-6.el3.i386",
"3AS:ntp-0:4.1.2-6.el3.ia64",
"3AS:ntp-0:4.1.2-6.el3.ppc",
"3AS:ntp-0:4.1.2-6.el3.s390",
"3AS:ntp-0:4.1.2-6.el3.s390x",
"3AS:ntp-0:4.1.2-6.el3.src",
"3AS:ntp-0:4.1.2-6.el3.x86_64",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.i386",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.ia64",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.ppc",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.s390",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.s390x",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"3Desktop:ntp-0:4.1.2-6.el3.i386",
"3Desktop:ntp-0:4.1.2-6.el3.ia64",
"3Desktop:ntp-0:4.1.2-6.el3.ppc",
"3Desktop:ntp-0:4.1.2-6.el3.s390",
"3Desktop:ntp-0:4.1.2-6.el3.s390x",
"3Desktop:ntp-0:4.1.2-6.el3.src",
"3Desktop:ntp-0:4.1.2-6.el3.x86_64",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.i386",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.ia64",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.ppc",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.s390",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.s390x",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"3ES:ntp-0:4.1.2-6.el3.i386",
"3ES:ntp-0:4.1.2-6.el3.ia64",
"3ES:ntp-0:4.1.2-6.el3.ppc",
"3ES:ntp-0:4.1.2-6.el3.s390",
"3ES:ntp-0:4.1.2-6.el3.s390x",
"3ES:ntp-0:4.1.2-6.el3.src",
"3ES:ntp-0:4.1.2-6.el3.x86_64",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.i386",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.ia64",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.ppc",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.s390",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.s390x",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"3WS:ntp-0:4.1.2-6.el3.i386",
"3WS:ntp-0:4.1.2-6.el3.ia64",
"3WS:ntp-0:4.1.2-6.el3.ppc",
"3WS:ntp-0:4.1.2-6.el3.s390",
"3WS:ntp-0:4.1.2-6.el3.s390x",
"3WS:ntp-0:4.1.2-6.el3.src",
"3WS:ntp-0:4.1.2-6.el3.x86_64",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.i386",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.ia64",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.ppc",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.s390",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.s390x",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2009:1651"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"3AS:ntp-0:4.1.2-6.el3.i386",
"3AS:ntp-0:4.1.2-6.el3.ia64",
"3AS:ntp-0:4.1.2-6.el3.ppc",
"3AS:ntp-0:4.1.2-6.el3.s390",
"3AS:ntp-0:4.1.2-6.el3.s390x",
"3AS:ntp-0:4.1.2-6.el3.src",
"3AS:ntp-0:4.1.2-6.el3.x86_64",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.i386",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.ia64",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.ppc",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.s390",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.s390x",
"3AS:ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"3Desktop:ntp-0:4.1.2-6.el3.i386",
"3Desktop:ntp-0:4.1.2-6.el3.ia64",
"3Desktop:ntp-0:4.1.2-6.el3.ppc",
"3Desktop:ntp-0:4.1.2-6.el3.s390",
"3Desktop:ntp-0:4.1.2-6.el3.s390x",
"3Desktop:ntp-0:4.1.2-6.el3.src",
"3Desktop:ntp-0:4.1.2-6.el3.x86_64",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.i386",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.ia64",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.ppc",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.s390",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.s390x",
"3Desktop:ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"3ES:ntp-0:4.1.2-6.el3.i386",
"3ES:ntp-0:4.1.2-6.el3.ia64",
"3ES:ntp-0:4.1.2-6.el3.ppc",
"3ES:ntp-0:4.1.2-6.el3.s390",
"3ES:ntp-0:4.1.2-6.el3.s390x",
"3ES:ntp-0:4.1.2-6.el3.src",
"3ES:ntp-0:4.1.2-6.el3.x86_64",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.i386",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.ia64",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.ppc",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.s390",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.s390x",
"3ES:ntp-debuginfo-0:4.1.2-6.el3.x86_64",
"3WS:ntp-0:4.1.2-6.el3.i386",
"3WS:ntp-0:4.1.2-6.el3.ia64",
"3WS:ntp-0:4.1.2-6.el3.ppc",
"3WS:ntp-0:4.1.2-6.el3.s390",
"3WS:ntp-0:4.1.2-6.el3.s390x",
"3WS:ntp-0:4.1.2-6.el3.src",
"3WS:ntp-0:4.1.2-6.el3.x86_64",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.i386",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.ia64",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.ppc",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.s390",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.s390x",
"3WS:ntp-debuginfo-0:4.1.2-6.el3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "ntpd: DoS with mode 7 packets (VU#568372)"
}
]
}
RHSA-2009:1040
Vulnerability from csaf_redhat
Published
2009-05-18 20:51
Modified
2025-10-09 13:17
Summary
Red Hat Security Advisory: ntp security update
Notes
Topic
An updated ntp package that fixes two security issues is now available for
Red Hat Enterprise Linux 4.
This update has been rated as having critical security impact by the Red
Hat Security Response Team.
Details
The Network Time Protocol (NTP) is used to synchronize a computer's time
with a referenced time source.
A buffer overflow flaw was discovered in the ntpd daemon's NTPv4
authentication code. If ntpd was configured to use public key cryptography
for NTP packet authentication, a remote attacker could use this flaw to
send a specially-crafted request packet that could crash ntpd or,
potentially, execute arbitrary code with the privileges of the "ntp" user.
(CVE-2009-1252)
Note: NTP authentication is not enabled by default.
A buffer overflow flaw was found in the ntpq diagnostic command. A
malicious, remote server could send a specially-crafted reply to an ntpq
request that could crash ntpq or, potentially, execute arbitrary code with
the privileges of the user running the ntpq command. (CVE-2009-0159)
All ntp users are advised to upgrade to this updated package, which
contains backported patches to resolve these issues. After installing the
update, the ntpd daemon will be restarted automatically.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Critical"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An updated ntp package that fixes two security issues is now available for\nRed Hat Enterprise Linux 4.\n\nThis update has been rated as having critical security impact by the Red\nHat Security Response Team.",
"title": "Topic"
},
{
"category": "general",
"text": "The Network Time Protocol (NTP) is used to synchronize a computer\u0027s time\nwith a referenced time source.\n\nA buffer overflow flaw was discovered in the ntpd daemon\u0027s NTPv4\nauthentication code. If ntpd was configured to use public key cryptography\nfor NTP packet authentication, a remote attacker could use this flaw to\nsend a specially-crafted request packet that could crash ntpd or,\npotentially, execute arbitrary code with the privileges of the \"ntp\" user.\n(CVE-2009-1252)\n\nNote: NTP authentication is not enabled by default.\n\nA buffer overflow flaw was found in the ntpq diagnostic command. A\nmalicious, remote server could send a specially-crafted reply to an ntpq\nrequest that could crash ntpq or, potentially, execute arbitrary code with\nthe privileges of the user running the ntpq command. (CVE-2009-0159)\n\nAll ntp users are advised to upgrade to this updated package, which\ncontains backported patches to resolve these issues. After installing the\nupdate, the ntpd daemon will be restarted automatically.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2009:1040",
"url": "https://access.redhat.com/errata/RHSA-2009:1040"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#critical",
"url": "https://access.redhat.com/security/updates/classification/#critical"
},
{
"category": "external",
"summary": "490617",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=490617"
},
{
"category": "external",
"summary": "499694",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=499694"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_1040.json"
}
],
"title": "Red Hat Security Advisory: ntp security update",
"tracking": {
"current_release_date": "2025-10-09T13:17:05+00:00",
"generator": {
"date": "2025-10-09T13:17:05+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.9"
}
},
"id": "RHSA-2009:1040",
"initial_release_date": "2009-05-18T20:51:00+00:00",
"revision_history": [
{
"date": "2009-05-18T20:51:00+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2009-05-18T16:53:21+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-10-09T13:17:05+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AS version 4",
"product": {
"name": "Red Hat Enterprise Linux AS version 4",
"product_id": "4AS",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:4::as"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Desktop version 4",
"product": {
"name": "Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:4::desktop"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux ES version 4",
"product": {
"name": "Red Hat Enterprise Linux ES version 4",
"product_id": "4ES",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:4::es"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux WS version 4",
"product": {
"name": "Red Hat Enterprise Linux WS version 4",
"product_id": "4WS",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:4::ws"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AS EUS (v. 4.7)",
"product": {
"name": "Red Hat Enterprise Linux AS EUS (v. 4.7)",
"product_id": "4AS-4.7.z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:rhel_eus:4.7::as"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux ES EUS (v. 4.7)",
"product": {
"name": "Red Hat Enterprise Linux ES EUS (v. 4.7)",
"product_id": "4ES-4.7.z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:rhel_eus:4.7::es"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"product": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"product_id": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp@4.2.0.a.20040617-8.el4_7.2?arch=ia64"
}
}
},
{
"category": "product_version",
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"product": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"product_id": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp-debuginfo@4.2.0.a.20040617-8.el4_7.2?arch=ia64"
}
}
}
],
"category": "architecture",
"name": "ia64"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"product": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"product_id": "ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp@4.2.0.a.20040617-8.el4_7.2?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"product": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"product_id": "ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp@4.2.0.a.20040617-8.el4_7.2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"product": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"product_id": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp-debuginfo@4.2.0.a.20040617-8.el4_7.2?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"product": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"product_id": "ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp@4.2.0.a.20040617-8.el4_7.2?arch=i386"
}
}
},
{
"category": "product_version",
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"product": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"product_id": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp-debuginfo@4.2.0.a.20040617-8.el4_7.2?arch=i386"
}
}
}
],
"category": "architecture",
"name": "i386"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"product": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"product_id": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp@4.2.0.a.20040617-8.el4_7.2?arch=ppc"
}
}
},
{
"category": "product_version",
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"product": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"product_id": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp-debuginfo@4.2.0.a.20040617-8.el4_7.2?arch=ppc"
}
}
}
],
"category": "architecture",
"name": "ppc"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"product": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"product_id": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp@4.2.0.a.20040617-8.el4_7.2?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"product": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"product_id": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp-debuginfo@4.2.0.a.20040617-8.el4_7.2?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"product": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"product_id": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp@4.2.0.a.20040617-8.el4_7.2?arch=s390"
}
}
},
{
"category": "product_version",
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"product": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"product_id": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp-debuginfo@4.2.0.a.20040617-8.el4_7.2?arch=s390"
}
}
}
],
"category": "architecture",
"name": "s390"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.i386 as a component of Red Hat Enterprise Linux AS EUS (v. 4.7)",
"product_id": "4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"relates_to_product_reference": "4AS-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64 as a component of Red Hat Enterprise Linux AS EUS (v. 4.7)",
"product_id": "4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"relates_to_product_reference": "4AS-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc as a component of Red Hat Enterprise Linux AS EUS (v. 4.7)",
"product_id": "4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"relates_to_product_reference": "4AS-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390 as a component of Red Hat Enterprise Linux AS EUS (v. 4.7)",
"product_id": "4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"relates_to_product_reference": "4AS-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x as a component of Red Hat Enterprise Linux AS EUS (v. 4.7)",
"product_id": "4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"relates_to_product_reference": "4AS-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.src as a component of Red Hat Enterprise Linux AS EUS (v. 4.7)",
"product_id": "4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.src"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"relates_to_product_reference": "4AS-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64 as a component of Red Hat Enterprise Linux AS EUS (v. 4.7)",
"product_id": "4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"relates_to_product_reference": "4AS-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386 as a component of Red Hat Enterprise Linux AS EUS (v. 4.7)",
"product_id": "4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"relates_to_product_reference": "4AS-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64 as a component of Red Hat Enterprise Linux AS EUS (v. 4.7)",
"product_id": "4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"relates_to_product_reference": "4AS-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc as a component of Red Hat Enterprise Linux AS EUS (v. 4.7)",
"product_id": "4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"relates_to_product_reference": "4AS-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390 as a component of Red Hat Enterprise Linux AS EUS (v. 4.7)",
"product_id": "4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"relates_to_product_reference": "4AS-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x as a component of Red Hat Enterprise Linux AS EUS (v. 4.7)",
"product_id": "4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"relates_to_product_reference": "4AS-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64 as a component of Red Hat Enterprise Linux AS EUS (v. 4.7)",
"product_id": "4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"relates_to_product_reference": "4AS-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.i386 as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64 as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390 as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.src as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.src"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64 as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386 as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64 as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390 as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64 as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.i386 as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64 as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390 as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.src as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.src"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64 as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386 as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64 as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390 as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64 as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.i386 as a component of Red Hat Enterprise Linux ES EUS (v. 4.7)",
"product_id": "4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"relates_to_product_reference": "4ES-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64 as a component of Red Hat Enterprise Linux ES EUS (v. 4.7)",
"product_id": "4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"relates_to_product_reference": "4ES-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc as a component of Red Hat Enterprise Linux ES EUS (v. 4.7)",
"product_id": "4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"relates_to_product_reference": "4ES-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390 as a component of Red Hat Enterprise Linux ES EUS (v. 4.7)",
"product_id": "4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"relates_to_product_reference": "4ES-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x as a component of Red Hat Enterprise Linux ES EUS (v. 4.7)",
"product_id": "4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"relates_to_product_reference": "4ES-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.src as a component of Red Hat Enterprise Linux ES EUS (v. 4.7)",
"product_id": "4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.src"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"relates_to_product_reference": "4ES-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64 as a component of Red Hat Enterprise Linux ES EUS (v. 4.7)",
"product_id": "4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"relates_to_product_reference": "4ES-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386 as a component of Red Hat Enterprise Linux ES EUS (v. 4.7)",
"product_id": "4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"relates_to_product_reference": "4ES-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64 as a component of Red Hat Enterprise Linux ES EUS (v. 4.7)",
"product_id": "4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"relates_to_product_reference": "4ES-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc as a component of Red Hat Enterprise Linux ES EUS (v. 4.7)",
"product_id": "4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"relates_to_product_reference": "4ES-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390 as a component of Red Hat Enterprise Linux ES EUS (v. 4.7)",
"product_id": "4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"relates_to_product_reference": "4ES-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x as a component of Red Hat Enterprise Linux ES EUS (v. 4.7)",
"product_id": "4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"relates_to_product_reference": "4ES-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64 as a component of Red Hat Enterprise Linux ES EUS (v. 4.7)",
"product_id": "4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"relates_to_product_reference": "4ES-4.7.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.i386 as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64 as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390 as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.src as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.src"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64 as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386 as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64 as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390 as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64 as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.i386 as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"relates_to_product_reference": "4WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64 as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"relates_to_product_reference": "4WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"relates_to_product_reference": "4WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390 as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"relates_to_product_reference": "4WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"relates_to_product_reference": "4WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.src as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.src"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"relates_to_product_reference": "4WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64 as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64"
},
"product_reference": "ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"relates_to_product_reference": "4WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386 as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"relates_to_product_reference": "4WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64 as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"relates_to_product_reference": "4WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"relates_to_product_reference": "4WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390 as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"relates_to_product_reference": "4WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"relates_to_product_reference": "4WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64 as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64"
},
"product_reference": "ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"relates_to_product_reference": "4WS"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2009-0159",
"cwe": {
"id": "CWE-121",
"name": "Stack-based Buffer Overflow"
},
"discovery_date": "2009-03-12T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "490617"
}
],
"notes": [
{
"category": "description",
"text": "Stack-based buffer overflow in the cookedprint function in ntpq/ntpq.c in ntpq in NTP before 4.2.4p7-RC2 allows remote NTP servers to execute arbitrary code via a crafted response.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ntp: buffer overflow in ntpq",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2009-0159"
},
{
"category": "external",
"summary": "RHBZ#490617",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=490617"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2009-0159",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0159"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-0159",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2009-0159"
}
],
"release_date": "2009-04-09T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2009-05-18T20:51:00+00:00",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2009:1040"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "ntp: buffer overflow in ntpq"
},
{
"cve": "CVE-2009-1252",
"cwe": {
"id": "CWE-121",
"name": "Stack-based Buffer Overflow"
},
"discovery_date": "2009-05-06T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "499694"
}
],
"notes": [
{
"category": "description",
"text": "Stack-based buffer overflow in the crypto_recv function in ntp_crypto.c in ntpd in NTP before 4.2.4p7 and 4.2.5 before 4.2.5p74, when OpenSSL and autokey are enabled, allows remote attackers to execute arbitrary code via a crafted packet containing an extension field.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ntp: remote arbitrary code execution vulnerability if autokeys is enabled",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2009-1252"
},
{
"category": "external",
"summary": "RHBZ#499694",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=499694"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2009-1252",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-1252"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-1252",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2009-1252"
}
],
"release_date": "2009-05-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2009-05-18T20:51:00+00:00",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2009:1040"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4AS-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4AS-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4AS:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4AS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4Desktop:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4Desktop:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4ES-4.7.z:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4ES-4.7.z:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4ES:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4ES:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.src",
"4WS:ntp-0:4.2.0.a.20040617-8.el4_7.2.x86_64",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.i386",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ia64",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.ppc",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.s390x",
"4WS:ntp-debuginfo-0:4.2.0.a.20040617-8.el4_7.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "ntp: remote arbitrary code execution vulnerability if autokeys is enabled"
}
]
}
rhsa-2009_1039
Vulnerability from csaf_redhat
Published
2009-05-18 20:33
Modified
2024-11-22 03:08
Summary
Red Hat Security Advisory: ntp security update
Notes
Topic
An updated ntp package that fixes two security issues is now available for
Red Hat Enterprise Linux 5.
This update has been rated as having important security impact by the Red
Hat Security Response Team.
Details
The Network Time Protocol (NTP) is used to synchronize a computer's time
with a referenced time source.
A buffer overflow flaw was discovered in the ntpd daemon's NTPv4
authentication code. If ntpd was configured to use public key cryptography
for NTP packet authentication, a remote attacker could use this flaw to
send a specially-crafted request packet that could crash ntpd.
(CVE-2009-1252)
Note: NTP authentication is not enabled by default.
A buffer overflow flaw was found in the ntpq diagnostic command. A
malicious, remote server could send a specially-crafted reply to an ntpq
request that could crash ntpq. (CVE-2009-0159)
All ntp users are advised to upgrade to this updated package, which
contains backported patches to resolve these issues. After installing the
update, the ntpd daemon will be restarted automatically.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An updated ntp package that fixes two security issues is now available for\nRed Hat Enterprise Linux 5.\n\nThis update has been rated as having important security impact by the Red\nHat Security Response Team.",
"title": "Topic"
},
{
"category": "general",
"text": "The Network Time Protocol (NTP) is used to synchronize a computer\u0027s time\nwith a referenced time source.\n\nA buffer overflow flaw was discovered in the ntpd daemon\u0027s NTPv4\nauthentication code. If ntpd was configured to use public key cryptography\nfor NTP packet authentication, a remote attacker could use this flaw to\nsend a specially-crafted request packet that could crash ntpd.\n(CVE-2009-1252)\n\nNote: NTP authentication is not enabled by default.\n\nA buffer overflow flaw was found in the ntpq diagnostic command. A\nmalicious, remote server could send a specially-crafted reply to an ntpq\nrequest that could crash ntpq. (CVE-2009-0159)\n\nAll ntp users are advised to upgrade to this updated package, which\ncontains backported patches to resolve these issues. After installing the\nupdate, the ntpd daemon will be restarted automatically.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2009:1039",
"url": "https://access.redhat.com/errata/RHSA-2009:1039"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "490617",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=490617"
},
{
"category": "external",
"summary": "499694",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=499694"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_1039.json"
}
],
"title": "Red Hat Security Advisory: ntp security update",
"tracking": {
"current_release_date": "2024-11-22T03:08:04+00:00",
"generator": {
"date": "2024-11-22T03:08:04+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2009:1039",
"initial_release_date": "2009-05-18T20:33:00+00:00",
"revision_history": [
{
"date": "2009-05-18T20:33:00+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2009-05-18T16:35:07+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-22T03:08:04+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Desktop (v. 5 client)",
"product": {
"name": "Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:5::client"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux (v. 5 server)",
"product": {
"name": "Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:5::server"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-0:4.2.2p1-9.el5_3.2.src",
"product": {
"name": "ntp-0:4.2.2p1-9.el5_3.2.src",
"product_id": "ntp-0:4.2.2p1-9.el5_3.2.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp@4.2.2p1-9.el5_3.2?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-0:4.2.2p1-9.el5_3.2.x86_64",
"product": {
"name": "ntp-0:4.2.2p1-9.el5_3.2.x86_64",
"product_id": "ntp-0:4.2.2p1-9.el5_3.2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp@4.2.2p1-9.el5_3.2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.x86_64",
"product": {
"name": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.x86_64",
"product_id": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp-debuginfo@4.2.2p1-9.el5_3.2?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-0:4.2.2p1-9.el5_3.2.i386",
"product": {
"name": "ntp-0:4.2.2p1-9.el5_3.2.i386",
"product_id": "ntp-0:4.2.2p1-9.el5_3.2.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp@4.2.2p1-9.el5_3.2?arch=i386"
}
}
},
{
"category": "product_version",
"name": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.i386",
"product": {
"name": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.i386",
"product_id": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp-debuginfo@4.2.2p1-9.el5_3.2?arch=i386"
}
}
}
],
"category": "architecture",
"name": "i386"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-0:4.2.2p1-9.el5_3.2.ia64",
"product": {
"name": "ntp-0:4.2.2p1-9.el5_3.2.ia64",
"product_id": "ntp-0:4.2.2p1-9.el5_3.2.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp@4.2.2p1-9.el5_3.2?arch=ia64"
}
}
},
{
"category": "product_version",
"name": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ia64",
"product": {
"name": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ia64",
"product_id": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp-debuginfo@4.2.2p1-9.el5_3.2?arch=ia64"
}
}
}
],
"category": "architecture",
"name": "ia64"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-0:4.2.2p1-9.el5_3.2.ppc",
"product": {
"name": "ntp-0:4.2.2p1-9.el5_3.2.ppc",
"product_id": "ntp-0:4.2.2p1-9.el5_3.2.ppc",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp@4.2.2p1-9.el5_3.2?arch=ppc"
}
}
},
{
"category": "product_version",
"name": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ppc",
"product": {
"name": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ppc",
"product_id": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ppc",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp-debuginfo@4.2.2p1-9.el5_3.2?arch=ppc"
}
}
}
],
"category": "architecture",
"name": "ppc"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-0:4.2.2p1-9.el5_3.2.s390x",
"product": {
"name": "ntp-0:4.2.2p1-9.el5_3.2.s390x",
"product_id": "ntp-0:4.2.2p1-9.el5_3.2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp@4.2.2p1-9.el5_3.2?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.s390x",
"product": {
"name": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.s390x",
"product_id": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp-debuginfo@4.2.2p1-9.el5_3.2?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.2p1-9.el5_3.2.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client:ntp-0:4.2.2p1-9.el5_3.2.i386"
},
"product_reference": "ntp-0:4.2.2p1-9.el5_3.2.i386",
"relates_to_product_reference": "5Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.2p1-9.el5_3.2.ia64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client:ntp-0:4.2.2p1-9.el5_3.2.ia64"
},
"product_reference": "ntp-0:4.2.2p1-9.el5_3.2.ia64",
"relates_to_product_reference": "5Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.2p1-9.el5_3.2.ppc as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client:ntp-0:4.2.2p1-9.el5_3.2.ppc"
},
"product_reference": "ntp-0:4.2.2p1-9.el5_3.2.ppc",
"relates_to_product_reference": "5Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.2p1-9.el5_3.2.s390x as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client:ntp-0:4.2.2p1-9.el5_3.2.s390x"
},
"product_reference": "ntp-0:4.2.2p1-9.el5_3.2.s390x",
"relates_to_product_reference": "5Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.2p1-9.el5_3.2.src as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client:ntp-0:4.2.2p1-9.el5_3.2.src"
},
"product_reference": "ntp-0:4.2.2p1-9.el5_3.2.src",
"relates_to_product_reference": "5Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.2p1-9.el5_3.2.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client:ntp-0:4.2.2p1-9.el5_3.2.x86_64"
},
"product_reference": "ntp-0:4.2.2p1-9.el5_3.2.x86_64",
"relates_to_product_reference": "5Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.i386"
},
"product_reference": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.i386",
"relates_to_product_reference": "5Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ia64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ia64"
},
"product_reference": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ia64",
"relates_to_product_reference": "5Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ppc as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ppc"
},
"product_reference": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ppc",
"relates_to_product_reference": "5Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.s390x as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.s390x"
},
"product_reference": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.s390x",
"relates_to_product_reference": "5Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.x86_64"
},
"product_reference": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.x86_64",
"relates_to_product_reference": "5Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.2p1-9.el5_3.2.i386 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:ntp-0:4.2.2p1-9.el5_3.2.i386"
},
"product_reference": "ntp-0:4.2.2p1-9.el5_3.2.i386",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.2p1-9.el5_3.2.ia64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:ntp-0:4.2.2p1-9.el5_3.2.ia64"
},
"product_reference": "ntp-0:4.2.2p1-9.el5_3.2.ia64",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.2p1-9.el5_3.2.ppc as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:ntp-0:4.2.2p1-9.el5_3.2.ppc"
},
"product_reference": "ntp-0:4.2.2p1-9.el5_3.2.ppc",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.2p1-9.el5_3.2.s390x as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:ntp-0:4.2.2p1-9.el5_3.2.s390x"
},
"product_reference": "ntp-0:4.2.2p1-9.el5_3.2.s390x",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.2p1-9.el5_3.2.src as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:ntp-0:4.2.2p1-9.el5_3.2.src"
},
"product_reference": "ntp-0:4.2.2p1-9.el5_3.2.src",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.2p1-9.el5_3.2.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:ntp-0:4.2.2p1-9.el5_3.2.x86_64"
},
"product_reference": "ntp-0:4.2.2p1-9.el5_3.2.x86_64",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.i386 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.i386"
},
"product_reference": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.i386",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ia64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ia64"
},
"product_reference": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ia64",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ppc as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ppc"
},
"product_reference": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ppc",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.s390x as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.s390x"
},
"product_reference": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.s390x",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.x86_64"
},
"product_reference": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.x86_64",
"relates_to_product_reference": "5Server"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2009-0159",
"cwe": {
"id": "CWE-121",
"name": "Stack-based Buffer Overflow"
},
"discovery_date": "2009-03-12T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "490617"
}
],
"notes": [
{
"category": "description",
"text": "Stack-based buffer overflow in the cookedprint function in ntpq/ntpq.c in ntpq in NTP before 4.2.4p7-RC2 allows remote NTP servers to execute arbitrary code via a crafted response.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ntp: buffer overflow in ntpq",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Client:ntp-0:4.2.2p1-9.el5_3.2.i386",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.ia64",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.ppc",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.s390x",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.src",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.x86_64",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.i386",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ia64",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ppc",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.s390x",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.x86_64",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.i386",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.ia64",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.ppc",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.s390x",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.src",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.x86_64",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.i386",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ia64",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ppc",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.s390x",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2009-0159"
},
{
"category": "external",
"summary": "RHBZ#490617",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=490617"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2009-0159",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0159"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-0159",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2009-0159"
}
],
"release_date": "2009-04-09T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2009-05-18T20:33:00+00:00",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"5Client:ntp-0:4.2.2p1-9.el5_3.2.i386",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.ia64",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.ppc",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.s390x",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.src",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.x86_64",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.i386",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ia64",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ppc",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.s390x",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.x86_64",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.i386",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.ia64",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.ppc",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.s390x",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.src",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.x86_64",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.i386",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ia64",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ppc",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.s390x",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2009:1039"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"5Client:ntp-0:4.2.2p1-9.el5_3.2.i386",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.ia64",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.ppc",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.s390x",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.src",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.x86_64",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.i386",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ia64",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ppc",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.s390x",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.x86_64",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.i386",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.ia64",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.ppc",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.s390x",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.src",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.x86_64",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.i386",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ia64",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ppc",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.s390x",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "ntp: buffer overflow in ntpq"
},
{
"cve": "CVE-2009-1252",
"cwe": {
"id": "CWE-121",
"name": "Stack-based Buffer Overflow"
},
"discovery_date": "2009-05-06T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "499694"
}
],
"notes": [
{
"category": "description",
"text": "Stack-based buffer overflow in the crypto_recv function in ntp_crypto.c in ntpd in NTP before 4.2.4p7 and 4.2.5 before 4.2.5p74, when OpenSSL and autokey are enabled, allows remote attackers to execute arbitrary code via a crafted packet containing an extension field.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ntp: remote arbitrary code execution vulnerability if autokeys is enabled",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Client:ntp-0:4.2.2p1-9.el5_3.2.i386",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.ia64",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.ppc",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.s390x",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.src",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.x86_64",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.i386",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ia64",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ppc",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.s390x",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.x86_64",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.i386",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.ia64",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.ppc",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.s390x",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.src",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.x86_64",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.i386",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ia64",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ppc",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.s390x",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2009-1252"
},
{
"category": "external",
"summary": "RHBZ#499694",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=499694"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2009-1252",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-1252"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-1252",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2009-1252"
}
],
"release_date": "2009-05-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2009-05-18T20:33:00+00:00",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"5Client:ntp-0:4.2.2p1-9.el5_3.2.i386",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.ia64",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.ppc",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.s390x",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.src",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.x86_64",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.i386",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ia64",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ppc",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.s390x",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.x86_64",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.i386",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.ia64",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.ppc",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.s390x",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.src",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.x86_64",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.i386",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ia64",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ppc",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.s390x",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2009:1039"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"5Client:ntp-0:4.2.2p1-9.el5_3.2.i386",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.ia64",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.ppc",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.s390x",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.src",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.x86_64",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.i386",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ia64",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ppc",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.s390x",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.x86_64",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.i386",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.ia64",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.ppc",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.s390x",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.src",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.x86_64",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.i386",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ia64",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ppc",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.s390x",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "ntp: remote arbitrary code execution vulnerability if autokeys is enabled"
}
]
}
rhsa-2009:1039
Vulnerability from csaf_redhat
Published
2009-05-18 20:33
Modified
2025-10-09 13:17
Summary
Red Hat Security Advisory: ntp security update
Notes
Topic
An updated ntp package that fixes two security issues is now available for
Red Hat Enterprise Linux 5.
This update has been rated as having important security impact by the Red
Hat Security Response Team.
Details
The Network Time Protocol (NTP) is used to synchronize a computer's time
with a referenced time source.
A buffer overflow flaw was discovered in the ntpd daemon's NTPv4
authentication code. If ntpd was configured to use public key cryptography
for NTP packet authentication, a remote attacker could use this flaw to
send a specially-crafted request packet that could crash ntpd.
(CVE-2009-1252)
Note: NTP authentication is not enabled by default.
A buffer overflow flaw was found in the ntpq diagnostic command. A
malicious, remote server could send a specially-crafted reply to an ntpq
request that could crash ntpq. (CVE-2009-0159)
All ntp users are advised to upgrade to this updated package, which
contains backported patches to resolve these issues. After installing the
update, the ntpd daemon will be restarted automatically.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An updated ntp package that fixes two security issues is now available for\nRed Hat Enterprise Linux 5.\n\nThis update has been rated as having important security impact by the Red\nHat Security Response Team.",
"title": "Topic"
},
{
"category": "general",
"text": "The Network Time Protocol (NTP) is used to synchronize a computer\u0027s time\nwith a referenced time source.\n\nA buffer overflow flaw was discovered in the ntpd daemon\u0027s NTPv4\nauthentication code. If ntpd was configured to use public key cryptography\nfor NTP packet authentication, a remote attacker could use this flaw to\nsend a specially-crafted request packet that could crash ntpd.\n(CVE-2009-1252)\n\nNote: NTP authentication is not enabled by default.\n\nA buffer overflow flaw was found in the ntpq diagnostic command. A\nmalicious, remote server could send a specially-crafted reply to an ntpq\nrequest that could crash ntpq. (CVE-2009-0159)\n\nAll ntp users are advised to upgrade to this updated package, which\ncontains backported patches to resolve these issues. After installing the\nupdate, the ntpd daemon will be restarted automatically.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2009:1039",
"url": "https://access.redhat.com/errata/RHSA-2009:1039"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "490617",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=490617"
},
{
"category": "external",
"summary": "499694",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=499694"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_1039.json"
}
],
"title": "Red Hat Security Advisory: ntp security update",
"tracking": {
"current_release_date": "2025-10-09T13:17:03+00:00",
"generator": {
"date": "2025-10-09T13:17:03+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.9"
}
},
"id": "RHSA-2009:1039",
"initial_release_date": "2009-05-18T20:33:00+00:00",
"revision_history": [
{
"date": "2009-05-18T20:33:00+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2009-05-18T16:35:07+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-10-09T13:17:03+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Desktop (v. 5 client)",
"product": {
"name": "Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:5::client"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux (v. 5 server)",
"product": {
"name": "Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:5::server"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-0:4.2.2p1-9.el5_3.2.src",
"product": {
"name": "ntp-0:4.2.2p1-9.el5_3.2.src",
"product_id": "ntp-0:4.2.2p1-9.el5_3.2.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp@4.2.2p1-9.el5_3.2?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-0:4.2.2p1-9.el5_3.2.x86_64",
"product": {
"name": "ntp-0:4.2.2p1-9.el5_3.2.x86_64",
"product_id": "ntp-0:4.2.2p1-9.el5_3.2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp@4.2.2p1-9.el5_3.2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.x86_64",
"product": {
"name": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.x86_64",
"product_id": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp-debuginfo@4.2.2p1-9.el5_3.2?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-0:4.2.2p1-9.el5_3.2.i386",
"product": {
"name": "ntp-0:4.2.2p1-9.el5_3.2.i386",
"product_id": "ntp-0:4.2.2p1-9.el5_3.2.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp@4.2.2p1-9.el5_3.2?arch=i386"
}
}
},
{
"category": "product_version",
"name": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.i386",
"product": {
"name": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.i386",
"product_id": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp-debuginfo@4.2.2p1-9.el5_3.2?arch=i386"
}
}
}
],
"category": "architecture",
"name": "i386"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-0:4.2.2p1-9.el5_3.2.ia64",
"product": {
"name": "ntp-0:4.2.2p1-9.el5_3.2.ia64",
"product_id": "ntp-0:4.2.2p1-9.el5_3.2.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp@4.2.2p1-9.el5_3.2?arch=ia64"
}
}
},
{
"category": "product_version",
"name": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ia64",
"product": {
"name": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ia64",
"product_id": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp-debuginfo@4.2.2p1-9.el5_3.2?arch=ia64"
}
}
}
],
"category": "architecture",
"name": "ia64"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-0:4.2.2p1-9.el5_3.2.ppc",
"product": {
"name": "ntp-0:4.2.2p1-9.el5_3.2.ppc",
"product_id": "ntp-0:4.2.2p1-9.el5_3.2.ppc",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp@4.2.2p1-9.el5_3.2?arch=ppc"
}
}
},
{
"category": "product_version",
"name": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ppc",
"product": {
"name": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ppc",
"product_id": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ppc",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp-debuginfo@4.2.2p1-9.el5_3.2?arch=ppc"
}
}
}
],
"category": "architecture",
"name": "ppc"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-0:4.2.2p1-9.el5_3.2.s390x",
"product": {
"name": "ntp-0:4.2.2p1-9.el5_3.2.s390x",
"product_id": "ntp-0:4.2.2p1-9.el5_3.2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp@4.2.2p1-9.el5_3.2?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.s390x",
"product": {
"name": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.s390x",
"product_id": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ntp-debuginfo@4.2.2p1-9.el5_3.2?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.2p1-9.el5_3.2.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client:ntp-0:4.2.2p1-9.el5_3.2.i386"
},
"product_reference": "ntp-0:4.2.2p1-9.el5_3.2.i386",
"relates_to_product_reference": "5Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.2p1-9.el5_3.2.ia64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client:ntp-0:4.2.2p1-9.el5_3.2.ia64"
},
"product_reference": "ntp-0:4.2.2p1-9.el5_3.2.ia64",
"relates_to_product_reference": "5Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.2p1-9.el5_3.2.ppc as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client:ntp-0:4.2.2p1-9.el5_3.2.ppc"
},
"product_reference": "ntp-0:4.2.2p1-9.el5_3.2.ppc",
"relates_to_product_reference": "5Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.2p1-9.el5_3.2.s390x as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client:ntp-0:4.2.2p1-9.el5_3.2.s390x"
},
"product_reference": "ntp-0:4.2.2p1-9.el5_3.2.s390x",
"relates_to_product_reference": "5Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.2p1-9.el5_3.2.src as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client:ntp-0:4.2.2p1-9.el5_3.2.src"
},
"product_reference": "ntp-0:4.2.2p1-9.el5_3.2.src",
"relates_to_product_reference": "5Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.2p1-9.el5_3.2.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client:ntp-0:4.2.2p1-9.el5_3.2.x86_64"
},
"product_reference": "ntp-0:4.2.2p1-9.el5_3.2.x86_64",
"relates_to_product_reference": "5Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.i386"
},
"product_reference": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.i386",
"relates_to_product_reference": "5Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ia64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ia64"
},
"product_reference": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ia64",
"relates_to_product_reference": "5Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ppc as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ppc"
},
"product_reference": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ppc",
"relates_to_product_reference": "5Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.s390x as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.s390x"
},
"product_reference": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.s390x",
"relates_to_product_reference": "5Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
"product_id": "5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.x86_64"
},
"product_reference": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.x86_64",
"relates_to_product_reference": "5Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.2p1-9.el5_3.2.i386 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:ntp-0:4.2.2p1-9.el5_3.2.i386"
},
"product_reference": "ntp-0:4.2.2p1-9.el5_3.2.i386",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.2p1-9.el5_3.2.ia64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:ntp-0:4.2.2p1-9.el5_3.2.ia64"
},
"product_reference": "ntp-0:4.2.2p1-9.el5_3.2.ia64",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.2p1-9.el5_3.2.ppc as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:ntp-0:4.2.2p1-9.el5_3.2.ppc"
},
"product_reference": "ntp-0:4.2.2p1-9.el5_3.2.ppc",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.2p1-9.el5_3.2.s390x as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:ntp-0:4.2.2p1-9.el5_3.2.s390x"
},
"product_reference": "ntp-0:4.2.2p1-9.el5_3.2.s390x",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.2p1-9.el5_3.2.src as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:ntp-0:4.2.2p1-9.el5_3.2.src"
},
"product_reference": "ntp-0:4.2.2p1-9.el5_3.2.src",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-0:4.2.2p1-9.el5_3.2.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:ntp-0:4.2.2p1-9.el5_3.2.x86_64"
},
"product_reference": "ntp-0:4.2.2p1-9.el5_3.2.x86_64",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.i386 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.i386"
},
"product_reference": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.i386",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ia64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ia64"
},
"product_reference": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ia64",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ppc as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ppc"
},
"product_reference": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ppc",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.s390x as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.s390x"
},
"product_reference": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.s390x",
"relates_to_product_reference": "5Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)",
"product_id": "5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.x86_64"
},
"product_reference": "ntp-debuginfo-0:4.2.2p1-9.el5_3.2.x86_64",
"relates_to_product_reference": "5Server"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2009-0159",
"cwe": {
"id": "CWE-121",
"name": "Stack-based Buffer Overflow"
},
"discovery_date": "2009-03-12T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "490617"
}
],
"notes": [
{
"category": "description",
"text": "Stack-based buffer overflow in the cookedprint function in ntpq/ntpq.c in ntpq in NTP before 4.2.4p7-RC2 allows remote NTP servers to execute arbitrary code via a crafted response.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ntp: buffer overflow in ntpq",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Client:ntp-0:4.2.2p1-9.el5_3.2.i386",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.ia64",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.ppc",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.s390x",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.src",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.x86_64",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.i386",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ia64",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ppc",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.s390x",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.x86_64",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.i386",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.ia64",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.ppc",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.s390x",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.src",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.x86_64",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.i386",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ia64",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ppc",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.s390x",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2009-0159"
},
{
"category": "external",
"summary": "RHBZ#490617",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=490617"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2009-0159",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0159"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-0159",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2009-0159"
}
],
"release_date": "2009-04-09T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2009-05-18T20:33:00+00:00",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"5Client:ntp-0:4.2.2p1-9.el5_3.2.i386",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.ia64",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.ppc",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.s390x",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.src",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.x86_64",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.i386",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ia64",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ppc",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.s390x",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.x86_64",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.i386",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.ia64",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.ppc",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.s390x",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.src",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.x86_64",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.i386",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ia64",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ppc",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.s390x",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2009:1039"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"5Client:ntp-0:4.2.2p1-9.el5_3.2.i386",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.ia64",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.ppc",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.s390x",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.src",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.x86_64",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.i386",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ia64",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ppc",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.s390x",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.x86_64",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.i386",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.ia64",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.ppc",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.s390x",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.src",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.x86_64",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.i386",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ia64",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ppc",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.s390x",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "ntp: buffer overflow in ntpq"
},
{
"cve": "CVE-2009-1252",
"cwe": {
"id": "CWE-121",
"name": "Stack-based Buffer Overflow"
},
"discovery_date": "2009-05-06T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "499694"
}
],
"notes": [
{
"category": "description",
"text": "Stack-based buffer overflow in the crypto_recv function in ntp_crypto.c in ntpd in NTP before 4.2.4p7 and 4.2.5 before 4.2.5p74, when OpenSSL and autokey are enabled, allows remote attackers to execute arbitrary code via a crafted packet containing an extension field.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ntp: remote arbitrary code execution vulnerability if autokeys is enabled",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Client:ntp-0:4.2.2p1-9.el5_3.2.i386",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.ia64",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.ppc",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.s390x",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.src",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.x86_64",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.i386",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ia64",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ppc",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.s390x",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.x86_64",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.i386",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.ia64",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.ppc",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.s390x",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.src",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.x86_64",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.i386",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ia64",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ppc",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.s390x",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2009-1252"
},
{
"category": "external",
"summary": "RHBZ#499694",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=499694"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2009-1252",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-1252"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-1252",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2009-1252"
}
],
"release_date": "2009-05-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2009-05-18T20:33:00+00:00",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"5Client:ntp-0:4.2.2p1-9.el5_3.2.i386",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.ia64",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.ppc",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.s390x",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.src",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.x86_64",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.i386",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ia64",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ppc",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.s390x",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.x86_64",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.i386",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.ia64",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.ppc",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.s390x",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.src",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.x86_64",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.i386",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ia64",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ppc",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.s390x",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2009:1039"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"5Client:ntp-0:4.2.2p1-9.el5_3.2.i386",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.ia64",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.ppc",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.s390x",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.src",
"5Client:ntp-0:4.2.2p1-9.el5_3.2.x86_64",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.i386",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ia64",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ppc",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.s390x",
"5Client:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.x86_64",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.i386",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.ia64",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.ppc",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.s390x",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.src",
"5Server:ntp-0:4.2.2p1-9.el5_3.2.x86_64",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.i386",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ia64",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.ppc",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.s390x",
"5Server:ntp-debuginfo-0:4.2.2p1-9.el5_3.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "ntp: remote arbitrary code execution vulnerability if autokeys is enabled"
}
]
}
opensuse-su-2024:10181-1
Vulnerability from csaf_opensuse
Published
2024-06-15 00:00
Modified
2024-06-15 00:00
Summary
ntp-4.2.8p9-1.1 on GA media
Notes
Title of the patch
ntp-4.2.8p9-1.1 on GA media
Description of the patch
These are all security issues fixed in the ntp-4.2.8p9-1.1 package on the GA media of openSUSE Tumbleweed.
Patchnames
openSUSE-Tumbleweed-2024-10181
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "ntp-4.2.8p9-1.1 on GA media",
"title": "Title of the patch"
},
{
"category": "description",
"text": "These are all security issues fixed in the ntp-4.2.8p9-1.1 package on the GA media of openSUSE Tumbleweed.",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-Tumbleweed-2024-10181",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_10181-1.json"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2009-0159 page",
"url": "https://www.suse.com/security/cve/CVE-2009-0159/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2009-1252 page",
"url": "https://www.suse.com/security/cve/CVE-2009-1252/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2013-5211 page",
"url": "https://www.suse.com/security/cve/CVE-2013-5211/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2014-9293 page",
"url": "https://www.suse.com/security/cve/CVE-2014-9293/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2014-9294 page",
"url": "https://www.suse.com/security/cve/CVE-2014-9294/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2014-9295 page",
"url": "https://www.suse.com/security/cve/CVE-2014-9295/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2014-9296 page",
"url": "https://www.suse.com/security/cve/CVE-2014-9296/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2014-9297 page",
"url": "https://www.suse.com/security/cve/CVE-2014-9297/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2014-9298 page",
"url": "https://www.suse.com/security/cve/CVE-2014-9298/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-1798 page",
"url": "https://www.suse.com/security/cve/CVE-2015-1798/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-1799 page",
"url": "https://www.suse.com/security/cve/CVE-2015-1799/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-5300 page",
"url": "https://www.suse.com/security/cve/CVE-2015-5300/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-7691 page",
"url": "https://www.suse.com/security/cve/CVE-2015-7691/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-7692 page",
"url": "https://www.suse.com/security/cve/CVE-2015-7692/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-7701 page",
"url": "https://www.suse.com/security/cve/CVE-2015-7701/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-7702 page",
"url": "https://www.suse.com/security/cve/CVE-2015-7702/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-7703 page",
"url": "https://www.suse.com/security/cve/CVE-2015-7703/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-7704 page",
"url": "https://www.suse.com/security/cve/CVE-2015-7704/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-7705 page",
"url": "https://www.suse.com/security/cve/CVE-2015-7705/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-7848 page",
"url": "https://www.suse.com/security/cve/CVE-2015-7848/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-7849 page",
"url": "https://www.suse.com/security/cve/CVE-2015-7849/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-7850 page",
"url": "https://www.suse.com/security/cve/CVE-2015-7850/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-7851 page",
"url": "https://www.suse.com/security/cve/CVE-2015-7851/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-7852 page",
"url": "https://www.suse.com/security/cve/CVE-2015-7852/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-7853 page",
"url": "https://www.suse.com/security/cve/CVE-2015-7853/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-7854 page",
"url": "https://www.suse.com/security/cve/CVE-2015-7854/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-7855 page",
"url": "https://www.suse.com/security/cve/CVE-2015-7855/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-7871 page",
"url": "https://www.suse.com/security/cve/CVE-2015-7871/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-7973 page",
"url": "https://www.suse.com/security/cve/CVE-2015-7973/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-7974 page",
"url": "https://www.suse.com/security/cve/CVE-2015-7974/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-7975 page",
"url": "https://www.suse.com/security/cve/CVE-2015-7975/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-7976 page",
"url": "https://www.suse.com/security/cve/CVE-2015-7976/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-7977 page",
"url": "https://www.suse.com/security/cve/CVE-2015-7977/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-7978 page",
"url": "https://www.suse.com/security/cve/CVE-2015-7978/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-7979 page",
"url": "https://www.suse.com/security/cve/CVE-2015-7979/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-8138 page",
"url": "https://www.suse.com/security/cve/CVE-2015-8138/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-8158 page",
"url": "https://www.suse.com/security/cve/CVE-2015-8158/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-1547 page",
"url": "https://www.suse.com/security/cve/CVE-2016-1547/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-1548 page",
"url": "https://www.suse.com/security/cve/CVE-2016-1548/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-1549 page",
"url": "https://www.suse.com/security/cve/CVE-2016-1549/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-1550 page",
"url": "https://www.suse.com/security/cve/CVE-2016-1550/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-1551 page",
"url": "https://www.suse.com/security/cve/CVE-2016-1551/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-2516 page",
"url": "https://www.suse.com/security/cve/CVE-2016-2516/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-2517 page",
"url": "https://www.suse.com/security/cve/CVE-2016-2517/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-2518 page",
"url": "https://www.suse.com/security/cve/CVE-2016-2518/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-2519 page",
"url": "https://www.suse.com/security/cve/CVE-2016-2519/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-4953 page",
"url": "https://www.suse.com/security/cve/CVE-2016-4953/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-4954 page",
"url": "https://www.suse.com/security/cve/CVE-2016-4954/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-4955 page",
"url": "https://www.suse.com/security/cve/CVE-2016-4955/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-4956 page",
"url": "https://www.suse.com/security/cve/CVE-2016-4956/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-4957 page",
"url": "https://www.suse.com/security/cve/CVE-2016-4957/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-7426 page",
"url": "https://www.suse.com/security/cve/CVE-2016-7426/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-7427 page",
"url": "https://www.suse.com/security/cve/CVE-2016-7427/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-7428 page",
"url": "https://www.suse.com/security/cve/CVE-2016-7428/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-7429 page",
"url": "https://www.suse.com/security/cve/CVE-2016-7429/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-7431 page",
"url": "https://www.suse.com/security/cve/CVE-2016-7431/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-7433 page",
"url": "https://www.suse.com/security/cve/CVE-2016-7433/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-7434 page",
"url": "https://www.suse.com/security/cve/CVE-2016-7434/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-9310 page",
"url": "https://www.suse.com/security/cve/CVE-2016-9310/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-9311 page",
"url": "https://www.suse.com/security/cve/CVE-2016-9311/"
}
],
"title": "ntp-4.2.8p9-1.1 on GA media",
"tracking": {
"current_release_date": "2024-06-15T00:00:00Z",
"generator": {
"date": "2024-06-15T00:00:00Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2024:10181-1",
"initial_release_date": "2024-06-15T00:00:00Z",
"revision_history": [
{
"date": "2024-06-15T00:00:00Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "ntp-4.2.8p9-1.1.aarch64",
"product": {
"name": "ntp-4.2.8p9-1.1.aarch64",
"product_id": "ntp-4.2.8p9-1.1.aarch64"
}
},
{
"category": "product_version",
"name": "ntp-doc-4.2.8p9-1.1.aarch64",
"product": {
"name": "ntp-doc-4.2.8p9-1.1.aarch64",
"product_id": "ntp-doc-4.2.8p9-1.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-4.2.8p9-1.1.ppc64le",
"product": {
"name": "ntp-4.2.8p9-1.1.ppc64le",
"product_id": "ntp-4.2.8p9-1.1.ppc64le"
}
},
{
"category": "product_version",
"name": "ntp-doc-4.2.8p9-1.1.ppc64le",
"product": {
"name": "ntp-doc-4.2.8p9-1.1.ppc64le",
"product_id": "ntp-doc-4.2.8p9-1.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-4.2.8p9-1.1.s390x",
"product": {
"name": "ntp-4.2.8p9-1.1.s390x",
"product_id": "ntp-4.2.8p9-1.1.s390x"
}
},
{
"category": "product_version",
"name": "ntp-doc-4.2.8p9-1.1.s390x",
"product": {
"name": "ntp-doc-4.2.8p9-1.1.s390x",
"product_id": "ntp-doc-4.2.8p9-1.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-4.2.8p9-1.1.x86_64",
"product": {
"name": "ntp-4.2.8p9-1.1.x86_64",
"product_id": "ntp-4.2.8p9-1.1.x86_64"
}
},
{
"category": "product_version",
"name": "ntp-doc-4.2.8p9-1.1.x86_64",
"product": {
"name": "ntp-doc-4.2.8p9-1.1.x86_64",
"product_id": "ntp-doc-4.2.8p9-1.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Tumbleweed",
"product": {
"name": "openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:tumbleweed"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-4.2.8p9-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64"
},
"product_reference": "ntp-4.2.8p9-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-4.2.8p9-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le"
},
"product_reference": "ntp-4.2.8p9-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-4.2.8p9-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x"
},
"product_reference": "ntp-4.2.8p9-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-4.2.8p9-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64"
},
"product_reference": "ntp-4.2.8p9-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-doc-4.2.8p9-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64"
},
"product_reference": "ntp-doc-4.2.8p9-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-doc-4.2.8p9-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le"
},
"product_reference": "ntp-doc-4.2.8p9-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-doc-4.2.8p9-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x"
},
"product_reference": "ntp-doc-4.2.8p9-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-doc-4.2.8p9-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
},
"product_reference": "ntp-doc-4.2.8p9-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2009-0159",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2009-0159"
}
],
"notes": [
{
"category": "general",
"text": "Stack-based buffer overflow in the cookedprint function in ntpq/ntpq.c in ntpq in NTP before 4.2.4p7-RC2 allows remote NTP servers to execute arbitrary code via a crafted response.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2009-0159",
"url": "https://www.suse.com/security/cve/CVE-2009-0159"
},
{
"category": "external",
"summary": "SUSE Bug 484653 for CVE-2009-0159",
"url": "https://bugzilla.suse.com/484653"
},
{
"category": "external",
"summary": "SUSE Bug 501632 for CVE-2009-0159",
"url": "https://bugzilla.suse.com/501632"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2009-0159"
},
{
"cve": "CVE-2009-1252",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2009-1252"
}
],
"notes": [
{
"category": "general",
"text": "Stack-based buffer overflow in the crypto_recv function in ntp_crypto.c in ntpd in NTP before 4.2.4p7 and 4.2.5 before 4.2.5p74, when OpenSSL and autokey are enabled, allows remote attackers to execute arbitrary code via a crafted packet containing an extension field.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2009-1252",
"url": "https://www.suse.com/security/cve/CVE-2009-1252"
},
{
"category": "external",
"summary": "SUSE Bug 501632 for CVE-2009-1252",
"url": "https://bugzilla.suse.com/501632"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2009-1252"
},
{
"cve": "CVE-2013-5211",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2013-5211"
}
],
"notes": [
{
"category": "general",
"text": "The monlist feature in ntp_request.c in ntpd in NTP before 4.2.7p26 allows remote attackers to cause a denial of service (traffic amplification) via forged (1) REQ_MON_GETLIST or (2) REQ_MON_GETLIST_1 requests, as exploited in the wild in December 2013.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2013-5211",
"url": "https://www.suse.com/security/cve/CVE-2013-5211"
},
{
"category": "external",
"summary": "SUSE Bug 857195 for CVE-2013-5211",
"url": "https://bugzilla.suse.com/857195"
},
{
"category": "external",
"summary": "SUSE Bug 889447 for CVE-2013-5211",
"url": "https://bugzilla.suse.com/889447"
},
{
"category": "external",
"summary": "SUSE Bug 959243 for CVE-2013-5211",
"url": "https://bugzilla.suse.com/959243"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2013-5211"
},
{
"cve": "CVE-2014-9293",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2014-9293"
}
],
"notes": [
{
"category": "general",
"text": "The config_auth function in ntpd in NTP before 4.2.7p11, when an auth key is not configured, improperly generates a key, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2014-9293",
"url": "https://www.suse.com/security/cve/CVE-2014-9293"
},
{
"category": "external",
"summary": "SUSE Bug 910764 for CVE-2014-9293",
"url": "https://bugzilla.suse.com/910764"
},
{
"category": "external",
"summary": "SUSE Bug 911053 for CVE-2014-9293",
"url": "https://bugzilla.suse.com/911053"
},
{
"category": "external",
"summary": "SUSE Bug 911792 for CVE-2014-9293",
"url": "https://bugzilla.suse.com/911792"
},
{
"category": "external",
"summary": "SUSE Bug 959243 for CVE-2014-9293",
"url": "https://bugzilla.suse.com/959243"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2014-9293"
},
{
"cve": "CVE-2014-9294",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2014-9294"
}
],
"notes": [
{
"category": "general",
"text": "util/ntp-keygen.c in ntp-keygen in NTP before 4.2.7p230 uses a weak RNG seed, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2014-9294",
"url": "https://www.suse.com/security/cve/CVE-2014-9294"
},
{
"category": "external",
"summary": "SUSE Bug 910764 for CVE-2014-9294",
"url": "https://bugzilla.suse.com/910764"
},
{
"category": "external",
"summary": "SUSE Bug 911053 for CVE-2014-9294",
"url": "https://bugzilla.suse.com/911053"
},
{
"category": "external",
"summary": "SUSE Bug 911792 for CVE-2014-9294",
"url": "https://bugzilla.suse.com/911792"
},
{
"category": "external",
"summary": "SUSE Bug 959243 for CVE-2014-9294",
"url": "https://bugzilla.suse.com/959243"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2014-9294"
},
{
"cve": "CVE-2014-9295",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2014-9295"
}
],
"notes": [
{
"category": "general",
"text": "Multiple stack-based buffer overflows in ntpd in NTP before 4.2.8 allow remote attackers to execute arbitrary code via a crafted packet, related to (1) the crypto_recv function when the Autokey Authentication feature is used, (2) the ctl_putdata function, and (3) the configure function.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2014-9295",
"url": "https://www.suse.com/security/cve/CVE-2014-9295"
},
{
"category": "external",
"summary": "SUSE Bug 910764 for CVE-2014-9295",
"url": "https://bugzilla.suse.com/910764"
},
{
"category": "external",
"summary": "SUSE Bug 911053 for CVE-2014-9295",
"url": "https://bugzilla.suse.com/911053"
},
{
"category": "external",
"summary": "SUSE Bug 911792 for CVE-2014-9295",
"url": "https://bugzilla.suse.com/911792"
},
{
"category": "external",
"summary": "SUSE Bug 916239 for CVE-2014-9295",
"url": "https://bugzilla.suse.com/916239"
},
{
"category": "external",
"summary": "SUSE Bug 959243 for CVE-2014-9295",
"url": "https://bugzilla.suse.com/959243"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2014-9295"
},
{
"cve": "CVE-2014-9296",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2014-9296"
}
],
"notes": [
{
"category": "general",
"text": "The receive function in ntp_proto.c in ntpd in NTP before 4.2.8 continues to execute after detecting a certain authentication error, which might allow remote attackers to trigger an unintended association change via crafted packets.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2014-9296",
"url": "https://www.suse.com/security/cve/CVE-2014-9296"
},
{
"category": "external",
"summary": "SUSE Bug 910764 for CVE-2014-9296",
"url": "https://bugzilla.suse.com/910764"
},
{
"category": "external",
"summary": "SUSE Bug 911053 for CVE-2014-9296",
"url": "https://bugzilla.suse.com/911053"
},
{
"category": "external",
"summary": "SUSE Bug 911792 for CVE-2014-9296",
"url": "https://bugzilla.suse.com/911792"
},
{
"category": "external",
"summary": "SUSE Bug 959243 for CVE-2014-9296",
"url": "https://bugzilla.suse.com/959243"
},
{
"category": "external",
"summary": "SUSE Bug 992991 for CVE-2014-9296",
"url": "https://bugzilla.suse.com/992991"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2014-9296"
},
{
"cve": "CVE-2014-9297",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2014-9297"
}
],
"notes": [
{
"category": "general",
"text": "DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-9750, CVE-2014-9751. Reason: this ID was intended for one issue, but was associated with two issues. Notes: All CVE users should consult CVE-2014-9750 and CVE-2014-9751 to identify the ID or IDs of interest. All references and descriptions in this candidate have been removed to prevent accidental usage",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2014-9297",
"url": "https://www.suse.com/security/cve/CVE-2014-9297"
},
{
"category": "external",
"summary": "SUSE Bug 911792 for CVE-2014-9297",
"url": "https://bugzilla.suse.com/911792"
},
{
"category": "external",
"summary": "SUSE Bug 948963 for CVE-2014-9297",
"url": "https://bugzilla.suse.com/948963"
},
{
"category": "external",
"summary": "SUSE Bug 959243 for CVE-2014-9297",
"url": "https://bugzilla.suse.com/959243"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2014-9297"
},
{
"cve": "CVE-2014-9298",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2014-9298"
}
],
"notes": [
{
"category": "general",
"text": "DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-9750, CVE-2014-9751. Reason: this ID was intended for one issue, but was associated with two issues. Notes: All CVE users should consult CVE-2014-9750 and CVE-2014-9751 to identify the ID or IDs of interest. All references and descriptions in this candidate have been removed to prevent accidental usage",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2014-9298",
"url": "https://www.suse.com/security/cve/CVE-2014-9298"
},
{
"category": "external",
"summary": "SUSE Bug 911792 for CVE-2014-9298",
"url": "https://bugzilla.suse.com/911792"
},
{
"category": "external",
"summary": "SUSE Bug 948963 for CVE-2014-9298",
"url": "https://bugzilla.suse.com/948963"
},
{
"category": "external",
"summary": "SUSE Bug 959243 for CVE-2014-9298",
"url": "https://bugzilla.suse.com/959243"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2014-9298"
},
{
"cve": "CVE-2015-1798",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-1798"
}
],
"notes": [
{
"category": "general",
"text": "The symmetric-key feature in the receive function in ntp_proto.c in ntpd in NTP 4.x before 4.2.8p2 requires a correct MAC only if the MAC field has a nonzero length, which makes it easier for man-in-the-middle attackers to spoof packets by omitting the MAC.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-1798",
"url": "https://www.suse.com/security/cve/CVE-2015-1798"
},
{
"category": "external",
"summary": "SUSE Bug 924202 for CVE-2015-1798",
"url": "https://bugzilla.suse.com/924202"
},
{
"category": "external",
"summary": "SUSE Bug 927497 for CVE-2015-1798",
"url": "https://bugzilla.suse.com/927497"
},
{
"category": "external",
"summary": "SUSE Bug 928321 for CVE-2015-1798",
"url": "https://bugzilla.suse.com/928321"
},
{
"category": "external",
"summary": "SUSE Bug 936327 for CVE-2015-1798",
"url": "https://bugzilla.suse.com/936327"
},
{
"category": "external",
"summary": "SUSE Bug 957163 for CVE-2015-1798",
"url": "https://bugzilla.suse.com/957163"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2015-1798"
},
{
"cve": "CVE-2015-1799",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-1799"
}
],
"notes": [
{
"category": "general",
"text": "The symmetric-key feature in the receive function in ntp_proto.c in ntpd in NTP 3.x and 4.x before 4.2.8p2 performs state-variable updates upon receiving certain invalid packets, which makes it easier for man-in-the-middle attackers to cause a denial of service (synchronization loss) by spoofing the source IP address of a peer.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-1799",
"url": "https://www.suse.com/security/cve/CVE-2015-1799"
},
{
"category": "external",
"summary": "SUSE Bug 924202 for CVE-2015-1799",
"url": "https://bugzilla.suse.com/924202"
},
{
"category": "external",
"summary": "SUSE Bug 927497 for CVE-2015-1799",
"url": "https://bugzilla.suse.com/927497"
},
{
"category": "external",
"summary": "SUSE Bug 928321 for CVE-2015-1799",
"url": "https://bugzilla.suse.com/928321"
},
{
"category": "external",
"summary": "SUSE Bug 936327 for CVE-2015-1799",
"url": "https://bugzilla.suse.com/936327"
},
{
"category": "external",
"summary": "SUSE Bug 943565 for CVE-2015-1799",
"url": "https://bugzilla.suse.com/943565"
},
{
"category": "external",
"summary": "SUSE Bug 957163 for CVE-2015-1799",
"url": "https://bugzilla.suse.com/957163"
},
{
"category": "external",
"summary": "SUSE Bug 959243 for CVE-2015-1799",
"url": "https://bugzilla.suse.com/959243"
},
{
"category": "external",
"summary": "SUSE Bug 962624 for CVE-2015-1799",
"url": "https://bugzilla.suse.com/962624"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2015-1799"
},
{
"cve": "CVE-2015-5300",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-5300"
}
],
"notes": [
{
"category": "general",
"text": "The panic_gate check in NTP before 4.2.8p5 is only re-enabled after the first change to the system clock that was greater than 128 milliseconds by default, which allows remote attackers to set NTP to an arbitrary time when started with the -g option, or to alter the time by up to 900 seconds otherwise by responding to an unspecified number of requests from trusted sources, and leveraging a resulting denial of service (abort and restart).",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-5300",
"url": "https://www.suse.com/security/cve/CVE-2015-5300"
},
{
"category": "external",
"summary": "SUSE Bug 951629 for CVE-2015-5300",
"url": "https://bugzilla.suse.com/951629"
},
{
"category": "external",
"summary": "SUSE Bug 959243 for CVE-2015-5300",
"url": "https://bugzilla.suse.com/959243"
},
{
"category": "external",
"summary": "SUSE Bug 962624 for CVE-2015-5300",
"url": "https://bugzilla.suse.com/962624"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2015-5300"
},
{
"cve": "CVE-2015-7691",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-7691"
}
],
"notes": [
{
"category": "general",
"text": "The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) via crafted packets containing particular autokey operations. NOTE: This vulnerability exists due to an incomplete fix for CVE-2014-9750.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-7691",
"url": "https://www.suse.com/security/cve/CVE-2015-7691"
},
{
"category": "external",
"summary": "SUSE Bug 1010964 for CVE-2015-7691",
"url": "https://bugzilla.suse.com/1010964"
},
{
"category": "external",
"summary": "SUSE Bug 911792 for CVE-2015-7691",
"url": "https://bugzilla.suse.com/911792"
},
{
"category": "external",
"summary": "SUSE Bug 951608 for CVE-2015-7691",
"url": "https://bugzilla.suse.com/951608"
},
{
"category": "external",
"summary": "SUSE Bug 959243 for CVE-2015-7691",
"url": "https://bugzilla.suse.com/959243"
},
{
"category": "external",
"summary": "SUSE Bug 992991 for CVE-2015-7691",
"url": "https://bugzilla.suse.com/992991"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2015-7691"
},
{
"cve": "CVE-2015-7692",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-7692"
}
],
"notes": [
{
"category": "general",
"text": "The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash). NOTE: This vulnerability exists due to an incomplete fix for CVE-2014-9750.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-7692",
"url": "https://www.suse.com/security/cve/CVE-2015-7692"
},
{
"category": "external",
"summary": "SUSE Bug 1010964 for CVE-2015-7692",
"url": "https://bugzilla.suse.com/1010964"
},
{
"category": "external",
"summary": "SUSE Bug 911792 for CVE-2015-7692",
"url": "https://bugzilla.suse.com/911792"
},
{
"category": "external",
"summary": "SUSE Bug 951608 for CVE-2015-7692",
"url": "https://bugzilla.suse.com/951608"
},
{
"category": "external",
"summary": "SUSE Bug 959243 for CVE-2015-7692",
"url": "https://bugzilla.suse.com/959243"
},
{
"category": "external",
"summary": "SUSE Bug 992991 for CVE-2015-7692",
"url": "https://bugzilla.suse.com/992991"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2015-7692"
},
{
"cve": "CVE-2015-7701",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-7701"
}
],
"notes": [
{
"category": "general",
"text": "Memory leak in the CRYPTO_ASSOC function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (memory consumption).",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-7701",
"url": "https://www.suse.com/security/cve/CVE-2015-7701"
},
{
"category": "external",
"summary": "SUSE Bug 1010964 for CVE-2015-7701",
"url": "https://bugzilla.suse.com/1010964"
},
{
"category": "external",
"summary": "SUSE Bug 951608 for CVE-2015-7701",
"url": "https://bugzilla.suse.com/951608"
},
{
"category": "external",
"summary": "SUSE Bug 959243 for CVE-2015-7701",
"url": "https://bugzilla.suse.com/959243"
},
{
"category": "external",
"summary": "SUSE Bug 992991 for CVE-2015-7701",
"url": "https://bugzilla.suse.com/992991"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2015-7701"
},
{
"cve": "CVE-2015-7702",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-7702"
}
],
"notes": [
{
"category": "general",
"text": "The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash). NOTE: This vulnerability exists due to an incomplete fix for CVE-2014-9750.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-7702",
"url": "https://www.suse.com/security/cve/CVE-2015-7702"
},
{
"category": "external",
"summary": "SUSE Bug 1010964 for CVE-2015-7702",
"url": "https://bugzilla.suse.com/1010964"
},
{
"category": "external",
"summary": "SUSE Bug 911792 for CVE-2015-7702",
"url": "https://bugzilla.suse.com/911792"
},
{
"category": "external",
"summary": "SUSE Bug 951608 for CVE-2015-7702",
"url": "https://bugzilla.suse.com/951608"
},
{
"category": "external",
"summary": "SUSE Bug 959243 for CVE-2015-7702",
"url": "https://bugzilla.suse.com/959243"
},
{
"category": "external",
"summary": "SUSE Bug 992991 for CVE-2015-7702",
"url": "https://bugzilla.suse.com/992991"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2015-7702"
},
{
"cve": "CVE-2015-7703",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-7703"
}
],
"notes": [
{
"category": "general",
"text": "The \"pidfile\" or \"driftfile\" directives in NTP ntpd 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77, when ntpd is configured to allow remote configuration, allows remote attackers with an IP address that is allowed to send configuration requests, and with knowledge of the remote configuration password to write to arbitrary files via the :config command.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-7703",
"url": "https://www.suse.com/security/cve/CVE-2015-7703"
},
{
"category": "external",
"summary": "SUSE Bug 1010964 for CVE-2015-7703",
"url": "https://bugzilla.suse.com/1010964"
},
{
"category": "external",
"summary": "SUSE Bug 943216 for CVE-2015-7703",
"url": "https://bugzilla.suse.com/943216"
},
{
"category": "external",
"summary": "SUSE Bug 943218 for CVE-2015-7703",
"url": "https://bugzilla.suse.com/943218"
},
{
"category": "external",
"summary": "SUSE Bug 943219 for CVE-2015-7703",
"url": "https://bugzilla.suse.com/943219"
},
{
"category": "external",
"summary": "SUSE Bug 943221 for CVE-2015-7703",
"url": "https://bugzilla.suse.com/943221"
},
{
"category": "external",
"summary": "SUSE Bug 951608 for CVE-2015-7703",
"url": "https://bugzilla.suse.com/951608"
},
{
"category": "external",
"summary": "SUSE Bug 959243 for CVE-2015-7703",
"url": "https://bugzilla.suse.com/959243"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2015-7703"
},
{
"cve": "CVE-2015-7704",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-7704"
}
],
"notes": [
{
"category": "general",
"text": "The ntpd client in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service via a number of crafted \"KOD\" messages.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-7704",
"url": "https://www.suse.com/security/cve/CVE-2015-7704"
},
{
"category": "external",
"summary": "SUSE Bug 1010964 for CVE-2015-7704",
"url": "https://bugzilla.suse.com/1010964"
},
{
"category": "external",
"summary": "SUSE Bug 951608 for CVE-2015-7704",
"url": "https://bugzilla.suse.com/951608"
},
{
"category": "external",
"summary": "SUSE Bug 952611 for CVE-2015-7704",
"url": "https://bugzilla.suse.com/952611"
},
{
"category": "external",
"summary": "SUSE Bug 959243 for CVE-2015-7704",
"url": "https://bugzilla.suse.com/959243"
},
{
"category": "external",
"summary": "SUSE Bug 977446 for CVE-2015-7704",
"url": "https://bugzilla.suse.com/977446"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2015-7704"
},
{
"cve": "CVE-2015-7705",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-7705"
}
],
"notes": [
{
"category": "general",
"text": "The rate limiting feature in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to have unspecified impact via a large number of crafted requests.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-7705",
"url": "https://www.suse.com/security/cve/CVE-2015-7705"
},
{
"category": "external",
"summary": "SUSE Bug 1010964 for CVE-2015-7705",
"url": "https://bugzilla.suse.com/1010964"
},
{
"category": "external",
"summary": "SUSE Bug 951608 for CVE-2015-7705",
"url": "https://bugzilla.suse.com/951608"
},
{
"category": "external",
"summary": "SUSE Bug 952611 for CVE-2015-7705",
"url": "https://bugzilla.suse.com/952611"
},
{
"category": "external",
"summary": "SUSE Bug 959243 for CVE-2015-7705",
"url": "https://bugzilla.suse.com/959243"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "critical"
}
],
"title": "CVE-2015-7705"
},
{
"cve": "CVE-2015-7848",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-7848"
}
],
"notes": [
{
"category": "general",
"text": "An integer overflow can occur in NTP-dev.4.3.70 leading to an out-of-bounds memory copy operation when processing a specially crafted private mode packet. The crafted packet needs to have the correct message authentication code and a valid timestamp. When processed by the NTP daemon, it leads to an immediate crash.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-7848",
"url": "https://www.suse.com/security/cve/CVE-2015-7848"
},
{
"category": "external",
"summary": "SUSE Bug 1010964 for CVE-2015-7848",
"url": "https://bugzilla.suse.com/1010964"
},
{
"category": "external",
"summary": "SUSE Bug 951608 for CVE-2015-7848",
"url": "https://bugzilla.suse.com/951608"
},
{
"category": "external",
"summary": "SUSE Bug 959243 for CVE-2015-7848",
"url": "https://bugzilla.suse.com/959243"
},
{
"category": "external",
"summary": "SUSE Bug 992991 for CVE-2015-7848",
"url": "https://bugzilla.suse.com/992991"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2015-7848"
},
{
"cve": "CVE-2015-7849",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-7849"
}
],
"notes": [
{
"category": "general",
"text": "Use-after-free vulnerability in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote authenticated users to possibly execute arbitrary code or cause a denial of service (crash) via crafted packets.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-7849",
"url": "https://www.suse.com/security/cve/CVE-2015-7849"
},
{
"category": "external",
"summary": "SUSE Bug 1010964 for CVE-2015-7849",
"url": "https://bugzilla.suse.com/1010964"
},
{
"category": "external",
"summary": "SUSE Bug 951608 for CVE-2015-7849",
"url": "https://bugzilla.suse.com/951608"
},
{
"category": "external",
"summary": "SUSE Bug 959243 for CVE-2015-7849",
"url": "https://bugzilla.suse.com/959243"
},
{
"category": "external",
"summary": "SUSE Bug 992991 for CVE-2015-7849",
"url": "https://bugzilla.suse.com/992991"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2015-7849"
},
{
"cve": "CVE-2015-7850",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-7850"
}
],
"notes": [
{
"category": "general",
"text": "ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote authenticated users to cause a denial of service (infinite loop or crash) by pointing the key file at the log file.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-7850",
"url": "https://www.suse.com/security/cve/CVE-2015-7850"
},
{
"category": "external",
"summary": "SUSE Bug 1010964 for CVE-2015-7850",
"url": "https://bugzilla.suse.com/1010964"
},
{
"category": "external",
"summary": "SUSE Bug 951608 for CVE-2015-7850",
"url": "https://bugzilla.suse.com/951608"
},
{
"category": "external",
"summary": "SUSE Bug 959243 for CVE-2015-7850",
"url": "https://bugzilla.suse.com/959243"
},
{
"category": "external",
"summary": "SUSE Bug 992991 for CVE-2015-7850",
"url": "https://bugzilla.suse.com/992991"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2015-7850"
},
{
"cve": "CVE-2015-7851",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-7851"
}
],
"notes": [
{
"category": "general",
"text": "Directory traversal vulnerability in the save_config function in ntpd in ntp_control.c in NTP before 4.2.8p4, when used on systems that do not use \u0027\\\u0027 or \u0027/\u0027 characters for directory separation such as OpenVMS, allows remote authenticated users to overwrite arbitrary files.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-7851",
"url": "https://www.suse.com/security/cve/CVE-2015-7851"
},
{
"category": "external",
"summary": "SUSE Bug 1010964 for CVE-2015-7851",
"url": "https://bugzilla.suse.com/1010964"
},
{
"category": "external",
"summary": "SUSE Bug 951608 for CVE-2015-7851",
"url": "https://bugzilla.suse.com/951608"
},
{
"category": "external",
"summary": "SUSE Bug 959243 for CVE-2015-7851",
"url": "https://bugzilla.suse.com/959243"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2015-7851"
},
{
"cve": "CVE-2015-7852",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-7852"
}
],
"notes": [
{
"category": "general",
"text": "ntpq in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) via crafted mode 6 response packets.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-7852",
"url": "https://www.suse.com/security/cve/CVE-2015-7852"
},
{
"category": "external",
"summary": "SUSE Bug 1010964 for CVE-2015-7852",
"url": "https://bugzilla.suse.com/1010964"
},
{
"category": "external",
"summary": "SUSE Bug 951608 for CVE-2015-7852",
"url": "https://bugzilla.suse.com/951608"
},
{
"category": "external",
"summary": "SUSE Bug 959243 for CVE-2015-7852",
"url": "https://bugzilla.suse.com/959243"
},
{
"category": "external",
"summary": "SUSE Bug 992991 for CVE-2015-7852",
"url": "https://bugzilla.suse.com/992991"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2015-7852"
},
{
"cve": "CVE-2015-7853",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-7853"
}
],
"notes": [
{
"category": "general",
"text": "The datalen parameter in the refclock driver in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to execute arbitrary code or cause a denial of service (crash) via a negative input value.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-7853",
"url": "https://www.suse.com/security/cve/CVE-2015-7853"
},
{
"category": "external",
"summary": "SUSE Bug 1010964 for CVE-2015-7853",
"url": "https://bugzilla.suse.com/1010964"
},
{
"category": "external",
"summary": "SUSE Bug 951608 for CVE-2015-7853",
"url": "https://bugzilla.suse.com/951608"
},
{
"category": "external",
"summary": "SUSE Bug 959243 for CVE-2015-7853",
"url": "https://bugzilla.suse.com/959243"
},
{
"category": "external",
"summary": "SUSE Bug 992991 for CVE-2015-7853",
"url": "https://bugzilla.suse.com/992991"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "critical"
}
],
"title": "CVE-2015-7853"
},
{
"cve": "CVE-2015-7854",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-7854"
}
],
"notes": [
{
"category": "general",
"text": "Buffer overflow in the password management functionality in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote authenticated users to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted key file.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-7854",
"url": "https://www.suse.com/security/cve/CVE-2015-7854"
},
{
"category": "external",
"summary": "SUSE Bug 1010964 for CVE-2015-7854",
"url": "https://bugzilla.suse.com/1010964"
},
{
"category": "external",
"summary": "SUSE Bug 951608 for CVE-2015-7854",
"url": "https://bugzilla.suse.com/951608"
},
{
"category": "external",
"summary": "SUSE Bug 959243 for CVE-2015-7854",
"url": "https://bugzilla.suse.com/959243"
},
{
"category": "external",
"summary": "SUSE Bug 992991 for CVE-2015-7854",
"url": "https://bugzilla.suse.com/992991"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2015-7854"
},
{
"cve": "CVE-2015-7855",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-7855"
}
],
"notes": [
{
"category": "general",
"text": "The decodenetnum function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (assertion failure) via a 6 or mode 7 packet containing a long data value.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-7855",
"url": "https://www.suse.com/security/cve/CVE-2015-7855"
},
{
"category": "external",
"summary": "SUSE Bug 1010964 for CVE-2015-7855",
"url": "https://bugzilla.suse.com/1010964"
},
{
"category": "external",
"summary": "SUSE Bug 951608 for CVE-2015-7855",
"url": "https://bugzilla.suse.com/951608"
},
{
"category": "external",
"summary": "SUSE Bug 959243 for CVE-2015-7855",
"url": "https://bugzilla.suse.com/959243"
},
{
"category": "external",
"summary": "SUSE Bug 992991 for CVE-2015-7855",
"url": "https://bugzilla.suse.com/992991"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2015-7855"
},
{
"cve": "CVE-2015-7871",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-7871"
}
],
"notes": [
{
"category": "general",
"text": "Crypto-NAK packets in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to bypass authentication.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-7871",
"url": "https://www.suse.com/security/cve/CVE-2015-7871"
},
{
"category": "external",
"summary": "SUSE Bug 1010964 for CVE-2015-7871",
"url": "https://bugzilla.suse.com/1010964"
},
{
"category": "external",
"summary": "SUSE Bug 951608 for CVE-2015-7871",
"url": "https://bugzilla.suse.com/951608"
},
{
"category": "external",
"summary": "SUSE Bug 952606 for CVE-2015-7871",
"url": "https://bugzilla.suse.com/952606"
},
{
"category": "external",
"summary": "SUSE Bug 959243 for CVE-2015-7871",
"url": "https://bugzilla.suse.com/959243"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "critical"
}
],
"title": "CVE-2015-7871"
},
{
"cve": "CVE-2015-7973",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-7973"
}
],
"notes": [
{
"category": "general",
"text": "NTP before 4.2.8p6 and 4.3.x before 4.3.90, when configured in broadcast mode, allows man-in-the-middle attackers to conduct replay attacks by sniffing the network.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-7973",
"url": "https://www.suse.com/security/cve/CVE-2015-7973"
},
{
"category": "external",
"summary": "SUSE Bug 959243 for CVE-2015-7973",
"url": "https://bugzilla.suse.com/959243"
},
{
"category": "external",
"summary": "SUSE Bug 962995 for CVE-2015-7973",
"url": "https://bugzilla.suse.com/962995"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2015-7973"
},
{
"cve": "CVE-2015-7974",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-7974"
}
],
"notes": [
{
"category": "general",
"text": "NTP 4.x before 4.2.8p6 and 4.3.x before 4.3.90 do not verify peer associations of symmetric keys when authenticating packets, which might allow remote attackers to conduct impersonation attacks via an arbitrary trusted key, aka a \"skeleton key.\"",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-7974",
"url": "https://www.suse.com/security/cve/CVE-2015-7974"
},
{
"category": "external",
"summary": "SUSE Bug 959243 for CVE-2015-7974",
"url": "https://bugzilla.suse.com/959243"
},
{
"category": "external",
"summary": "SUSE Bug 962960 for CVE-2015-7974",
"url": "https://bugzilla.suse.com/962960"
},
{
"category": "external",
"summary": "SUSE Bug 962995 for CVE-2015-7974",
"url": "https://bugzilla.suse.com/962995"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "low"
}
],
"title": "CVE-2015-7974"
},
{
"cve": "CVE-2015-7975",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-7975"
}
],
"notes": [
{
"category": "general",
"text": "The nextvar function in NTP before 4.2.8p6 and 4.3.x before 4.3.90 does not properly validate the length of its input, which allows an attacker to cause a denial of service (application crash).",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-7975",
"url": "https://www.suse.com/security/cve/CVE-2015-7975"
},
{
"category": "external",
"summary": "SUSE Bug 959243 for CVE-2015-7975",
"url": "https://bugzilla.suse.com/959243"
},
{
"category": "external",
"summary": "SUSE Bug 962988 for CVE-2015-7975",
"url": "https://bugzilla.suse.com/962988"
},
{
"category": "external",
"summary": "SUSE Bug 962995 for CVE-2015-7975",
"url": "https://bugzilla.suse.com/962995"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "low"
}
],
"title": "CVE-2015-7975"
},
{
"cve": "CVE-2015-7976",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-7976"
}
],
"notes": [
{
"category": "general",
"text": "The ntpq saveconfig command in NTP 4.1.2, 4.2.x before 4.2.8p6, 4.3, 4.3.25, 4.3.70, and 4.3.77 does not properly filter special characters, which allows attackers to cause unspecified impact via a crafted filename.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-7976",
"url": "https://www.suse.com/security/cve/CVE-2015-7976"
},
{
"category": "external",
"summary": "SUSE Bug 962802 for CVE-2015-7976",
"url": "https://bugzilla.suse.com/962802"
},
{
"category": "external",
"summary": "SUSE Bug 962995 for CVE-2015-7976",
"url": "https://bugzilla.suse.com/962995"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "low"
}
],
"title": "CVE-2015-7976"
},
{
"cve": "CVE-2015-7977",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-7977"
}
],
"notes": [
{
"category": "general",
"text": "ntpd in NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (NULL pointer dereference) via a ntpdc reslist command.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-7977",
"url": "https://www.suse.com/security/cve/CVE-2015-7977"
},
{
"category": "external",
"summary": "SUSE Bug 959243 for CVE-2015-7977",
"url": "https://bugzilla.suse.com/959243"
},
{
"category": "external",
"summary": "SUSE Bug 962970 for CVE-2015-7977",
"url": "https://bugzilla.suse.com/962970"
},
{
"category": "external",
"summary": "SUSE Bug 962995 for CVE-2015-7977",
"url": "https://bugzilla.suse.com/962995"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2015-7977"
},
{
"cve": "CVE-2015-7978",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-7978"
}
],
"notes": [
{
"category": "general",
"text": "NTP before 4.2.8p6 and 4.3.0 before 4.3.90 allows a remote attackers to cause a denial of service (stack exhaustion) via an ntpdc relist command, which triggers recursive traversal of the restriction list.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-7978",
"url": "https://www.suse.com/security/cve/CVE-2015-7978"
},
{
"category": "external",
"summary": "SUSE Bug 959243 for CVE-2015-7978",
"url": "https://bugzilla.suse.com/959243"
},
{
"category": "external",
"summary": "SUSE Bug 962970 for CVE-2015-7978",
"url": "https://bugzilla.suse.com/962970"
},
{
"category": "external",
"summary": "SUSE Bug 962995 for CVE-2015-7978",
"url": "https://bugzilla.suse.com/962995"
},
{
"category": "external",
"summary": "SUSE Bug 963000 for CVE-2015-7978",
"url": "https://bugzilla.suse.com/963000"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2015-7978"
},
{
"cve": "CVE-2015-7979",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-7979"
}
],
"notes": [
{
"category": "general",
"text": "NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (client-server association tear down) by sending broadcast packets with invalid authentication to a broadcast client.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-7979",
"url": "https://www.suse.com/security/cve/CVE-2015-7979"
},
{
"category": "external",
"summary": "SUSE Bug 959243 for CVE-2015-7979",
"url": "https://bugzilla.suse.com/959243"
},
{
"category": "external",
"summary": "SUSE Bug 962784 for CVE-2015-7979",
"url": "https://bugzilla.suse.com/962784"
},
{
"category": "external",
"summary": "SUSE Bug 962995 for CVE-2015-7979",
"url": "https://bugzilla.suse.com/962995"
},
{
"category": "external",
"summary": "SUSE Bug 977459 for CVE-2015-7979",
"url": "https://bugzilla.suse.com/977459"
},
{
"category": "external",
"summary": "SUSE Bug 982065 for CVE-2015-7979",
"url": "https://bugzilla.suse.com/982065"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2015-7979"
},
{
"cve": "CVE-2015-8138",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-8138"
}
],
"notes": [
{
"category": "general",
"text": "NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to bypass the origin timestamp validation via a packet with an origin timestamp set to zero.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-8138",
"url": "https://www.suse.com/security/cve/CVE-2015-8138"
},
{
"category": "external",
"summary": "SUSE Bug 951608 for CVE-2015-8138",
"url": "https://bugzilla.suse.com/951608"
},
{
"category": "external",
"summary": "SUSE Bug 959243 for CVE-2015-8138",
"url": "https://bugzilla.suse.com/959243"
},
{
"category": "external",
"summary": "SUSE Bug 963002 for CVE-2015-8138",
"url": "https://bugzilla.suse.com/963002"
},
{
"category": "external",
"summary": "SUSE Bug 974668 for CVE-2015-8138",
"url": "https://bugzilla.suse.com/974668"
},
{
"category": "external",
"summary": "SUSE Bug 977446 for CVE-2015-8138",
"url": "https://bugzilla.suse.com/977446"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2015-8138"
},
{
"cve": "CVE-2015-8158",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-8158"
}
],
"notes": [
{
"category": "general",
"text": "The getresponse function in ntpq in NTP versions before 4.2.8p9 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (infinite loop) via crafted packets with incorrect values.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-8158",
"url": "https://www.suse.com/security/cve/CVE-2015-8158"
},
{
"category": "external",
"summary": "SUSE Bug 959243 for CVE-2015-8158",
"url": "https://bugzilla.suse.com/959243"
},
{
"category": "external",
"summary": "SUSE Bug 962966 for CVE-2015-8158",
"url": "https://bugzilla.suse.com/962966"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "low"
}
],
"title": "CVE-2015-8158"
},
{
"cve": "CVE-2016-1547",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-1547"
}
],
"notes": [
{
"category": "general",
"text": "An off-path attacker can cause a preemptible client association to be demobilized in NTP 4.2.8p4 and earlier and NTPSec a5fb34b9cc89b92a8fef2f459004865c93bb7f92 by sending a crypto NAK packet to a victim client with a spoofed source address of an existing associated peer. This is true even if authentication is enabled.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-1547",
"url": "https://www.suse.com/security/cve/CVE-2016-1547"
},
{
"category": "external",
"summary": "SUSE Bug 962784 for CVE-2016-1547",
"url": "https://bugzilla.suse.com/962784"
},
{
"category": "external",
"summary": "SUSE Bug 977446 for CVE-2016-1547",
"url": "https://bugzilla.suse.com/977446"
},
{
"category": "external",
"summary": "SUSE Bug 977459 for CVE-2016-1547",
"url": "https://bugzilla.suse.com/977459"
},
{
"category": "external",
"summary": "SUSE Bug 982064 for CVE-2016-1547",
"url": "https://bugzilla.suse.com/982064"
},
{
"category": "external",
"summary": "SUSE Bug 982065 for CVE-2016-1547",
"url": "https://bugzilla.suse.com/982065"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2016-1547"
},
{
"cve": "CVE-2016-1548",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-1548"
}
],
"notes": [
{
"category": "general",
"text": "An attacker can spoof a packet from a legitimate ntpd server with an origin timestamp that matches the peer-\u003edst timestamp recorded for that server. After making this switch, the client in NTP 4.2.8p4 and earlier and NTPSec aa48d001683e5b791a743ec9c575aaf7d867a2b0c will reject all future legitimate server responses. It is possible to force the victim client to move time after the mode has been changed. ntpq gives no indication that the mode has been switched.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-1548",
"url": "https://www.suse.com/security/cve/CVE-2016-1548"
},
{
"category": "external",
"summary": "SUSE Bug 959243 for CVE-2016-1548",
"url": "https://bugzilla.suse.com/959243"
},
{
"category": "external",
"summary": "SUSE Bug 977446 for CVE-2016-1548",
"url": "https://bugzilla.suse.com/977446"
},
{
"category": "external",
"summary": "SUSE Bug 977461 for CVE-2016-1548",
"url": "https://bugzilla.suse.com/977461"
},
{
"category": "external",
"summary": "SUSE Bug 982068 for CVE-2016-1548",
"url": "https://bugzilla.suse.com/982068"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2016-1548"
},
{
"cve": "CVE-2016-1549",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-1549"
}
],
"notes": [
{
"category": "general",
"text": "A malicious authenticated peer can create arbitrarily-many ephemeral associations in order to win the clock selection algorithm in ntpd in NTP 4.2.8p4 and earlier and NTPsec 3e160db8dc248a0bcb053b56a80167dc742d2b74 and a5fb34b9cc89b92a8fef2f459004865c93bb7f92 and modify a victim\u0027s clock.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-1549",
"url": "https://www.suse.com/security/cve/CVE-2016-1549"
},
{
"category": "external",
"summary": "SUSE Bug 1083424 for CVE-2016-1549",
"url": "https://bugzilla.suse.com/1083424"
},
{
"category": "external",
"summary": "SUSE Bug 977446 for CVE-2016-1549",
"url": "https://bugzilla.suse.com/977446"
},
{
"category": "external",
"summary": "SUSE Bug 977451 for CVE-2016-1549",
"url": "https://bugzilla.suse.com/977451"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "low"
}
],
"title": "CVE-2016-1549"
},
{
"cve": "CVE-2016-1550",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-1550"
}
],
"notes": [
{
"category": "general",
"text": "An exploitable vulnerability exists in the message authentication functionality of libntp in ntp 4.2.8p4 and NTPSec a5fb34b9cc89b92a8fef2f459004865c93bb7f92. An attacker can send a series of crafted messages to attempt to recover the message digest key.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-1550",
"url": "https://www.suse.com/security/cve/CVE-2016-1550"
},
{
"category": "external",
"summary": "SUSE Bug 977446 for CVE-2016-1550",
"url": "https://bugzilla.suse.com/977446"
},
{
"category": "external",
"summary": "SUSE Bug 977464 for CVE-2016-1550",
"url": "https://bugzilla.suse.com/977464"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "low"
}
],
"title": "CVE-2016-1550"
},
{
"cve": "CVE-2016-1551",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-1551"
}
],
"notes": [
{
"category": "general",
"text": "ntpd in NTP 4.2.8p3 and NTPsec a5fb34b9cc89b92a8fef2f459004865c93bb7f92 relies on the underlying operating system to protect it from requests that impersonate reference clocks. Because reference clocks are treated like other peers and stored in the same structure, any packet with a source ip address of a reference clock (127.127.1.1 for example) that reaches the receive() function will match that reference clock\u0027s peer record and will be treated as a trusted peer. Any system that lacks the typical martian packet filtering which would block these packets is in danger of having its time controlled by an attacker.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-1551",
"url": "https://www.suse.com/security/cve/CVE-2016-1551"
},
{
"category": "external",
"summary": "SUSE Bug 977446 for CVE-2016-1551",
"url": "https://bugzilla.suse.com/977446"
},
{
"category": "external",
"summary": "SUSE Bug 977450 for CVE-2016-1551",
"url": "https://bugzilla.suse.com/977450"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "low"
}
],
"title": "CVE-2016-1551"
},
{
"cve": "CVE-2016-2516",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-2516"
}
],
"notes": [
{
"category": "general",
"text": "NTP before 4.2.8p7 and 4.3.x before 4.3.92, when mode7 is enabled, allows remote attackers to cause a denial of service (ntpd abort) by using the same IP address multiple times in an unconfig directive.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-2516",
"url": "https://www.suse.com/security/cve/CVE-2016-2516"
},
{
"category": "external",
"summary": "SUSE Bug 977446 for CVE-2016-2516",
"url": "https://bugzilla.suse.com/977446"
},
{
"category": "external",
"summary": "SUSE Bug 977452 for CVE-2016-2516",
"url": "https://bugzilla.suse.com/977452"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2016-2516"
},
{
"cve": "CVE-2016-2517",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-2517"
}
],
"notes": [
{
"category": "general",
"text": "NTP before 4.2.8p7 and 4.3.x before 4.3.92 allows remote attackers to cause a denial of service (prevent subsequent authentication) by leveraging knowledge of the controlkey or requestkey and sending a crafted packet to ntpd, which changes the value of trustedkey, controlkey, or requestkey. NOTE: this vulnerability exists because of a CVE-2016-2516 regression.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-2517",
"url": "https://www.suse.com/security/cve/CVE-2016-2517"
},
{
"category": "external",
"summary": "SUSE Bug 977446 for CVE-2016-2517",
"url": "https://bugzilla.suse.com/977446"
},
{
"category": "external",
"summary": "SUSE Bug 977455 for CVE-2016-2517",
"url": "https://bugzilla.suse.com/977455"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2016-2517"
},
{
"cve": "CVE-2016-2518",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-2518"
}
],
"notes": [
{
"category": "general",
"text": "The MATCH_ASSOC function in NTP before version 4.2.8p9 and 4.3.x before 4.3.92 allows remote attackers to cause an out-of-bounds reference via an addpeer request with a large hmode value.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-2518",
"url": "https://www.suse.com/security/cve/CVE-2016-2518"
},
{
"category": "external",
"summary": "SUSE Bug 977446 for CVE-2016-2518",
"url": "https://bugzilla.suse.com/977446"
},
{
"category": "external",
"summary": "SUSE Bug 977457 for CVE-2016-2518",
"url": "https://bugzilla.suse.com/977457"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "low"
}
],
"title": "CVE-2016-2518"
},
{
"cve": "CVE-2016-2519",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-2519"
}
],
"notes": [
{
"category": "general",
"text": "ntpd in NTP before 4.2.8p7 and 4.3.x before 4.3.92 allows remote attackers to cause a denial of service (ntpd abort) by a large request data value, which triggers the ctl_getitem function to return a NULL value.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-2519",
"url": "https://www.suse.com/security/cve/CVE-2016-2519"
},
{
"category": "external",
"summary": "SUSE Bug 959243 for CVE-2016-2519",
"url": "https://bugzilla.suse.com/959243"
},
{
"category": "external",
"summary": "SUSE Bug 977446 for CVE-2016-2519",
"url": "https://bugzilla.suse.com/977446"
},
{
"category": "external",
"summary": "SUSE Bug 977458 for CVE-2016-2519",
"url": "https://bugzilla.suse.com/977458"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2016-2519"
},
{
"cve": "CVE-2016-4953",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-4953"
}
],
"notes": [
{
"category": "general",
"text": "ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (ephemeral-association demobilization) by sending a spoofed crypto-NAK packet with incorrect authentication data at a certain time.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-4953",
"url": "https://www.suse.com/security/cve/CVE-2016-4953"
},
{
"category": "external",
"summary": "SUSE Bug 962784 for CVE-2016-4953",
"url": "https://bugzilla.suse.com/962784"
},
{
"category": "external",
"summary": "SUSE Bug 977459 for CVE-2016-4953",
"url": "https://bugzilla.suse.com/977459"
},
{
"category": "external",
"summary": "SUSE Bug 982056 for CVE-2016-4953",
"url": "https://bugzilla.suse.com/982056"
},
{
"category": "external",
"summary": "SUSE Bug 982065 for CVE-2016-4953",
"url": "https://bugzilla.suse.com/982065"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "low"
}
],
"title": "CVE-2016-4953"
},
{
"cve": "CVE-2016-4954",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-4954"
}
],
"notes": [
{
"category": "general",
"text": "The process_packet function in ntp_proto.c in ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (peer-variable modification) by sending spoofed packets from many source IP addresses in a certain scenario, as demonstrated by triggering an incorrect leap indication.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-4954",
"url": "https://www.suse.com/security/cve/CVE-2016-4954"
},
{
"category": "external",
"summary": "SUSE Bug 982056 for CVE-2016-4954",
"url": "https://bugzilla.suse.com/982056"
},
{
"category": "external",
"summary": "SUSE Bug 982066 for CVE-2016-4954",
"url": "https://bugzilla.suse.com/982066"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "low"
}
],
"title": "CVE-2016-4954"
},
{
"cve": "CVE-2016-4955",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-4955"
}
],
"notes": [
{
"category": "general",
"text": "ntpd in NTP 4.x before 4.2.8p8, when autokey is enabled, allows remote attackers to cause a denial of service (peer-variable clearing and association outage) by sending (1) a spoofed crypto-NAK packet or (2) a packet with an incorrect MAC value at a certain time.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-4955",
"url": "https://www.suse.com/security/cve/CVE-2016-4955"
},
{
"category": "external",
"summary": "SUSE Bug 982056 for CVE-2016-4955",
"url": "https://bugzilla.suse.com/982056"
},
{
"category": "external",
"summary": "SUSE Bug 982067 for CVE-2016-4955",
"url": "https://bugzilla.suse.com/982067"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "low"
}
],
"title": "CVE-2016-4955"
},
{
"cve": "CVE-2016-4956",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-4956"
}
],
"notes": [
{
"category": "general",
"text": "ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (interleaved-mode transition and time change) via a spoofed broadcast packet. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-1548.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-4956",
"url": "https://www.suse.com/security/cve/CVE-2016-4956"
},
{
"category": "external",
"summary": "SUSE Bug 977461 for CVE-2016-4956",
"url": "https://bugzilla.suse.com/977461"
},
{
"category": "external",
"summary": "SUSE Bug 982056 for CVE-2016-4956",
"url": "https://bugzilla.suse.com/982056"
},
{
"category": "external",
"summary": "SUSE Bug 982068 for CVE-2016-4956",
"url": "https://bugzilla.suse.com/982068"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "low"
}
],
"title": "CVE-2016-4956"
},
{
"cve": "CVE-2016-4957",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-4957"
}
],
"notes": [
{
"category": "general",
"text": "ntpd in NTP before 4.2.8p8 allows remote attackers to cause a denial of service (daemon crash) via a crypto-NAK packet. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-1547.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-4957",
"url": "https://www.suse.com/security/cve/CVE-2016-4957"
},
{
"category": "external",
"summary": "SUSE Bug 977459 for CVE-2016-4957",
"url": "https://bugzilla.suse.com/977459"
},
{
"category": "external",
"summary": "SUSE Bug 982056 for CVE-2016-4957",
"url": "https://bugzilla.suse.com/982056"
},
{
"category": "external",
"summary": "SUSE Bug 982064 for CVE-2016-4957",
"url": "https://bugzilla.suse.com/982064"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2016-4957"
},
{
"cve": "CVE-2016-7426",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-7426"
}
],
"notes": [
{
"category": "general",
"text": "NTP before 4.2.8p9 rate limits responses received from the configured sources when rate limiting for all associations is enabled, which allows remote attackers to cause a denial of service (prevent responses from the sources) by sending responses with a spoofed source address.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-7426",
"url": "https://www.suse.com/security/cve/CVE-2016-7426"
},
{
"category": "external",
"summary": "SUSE Bug 1011406 for CVE-2016-7426",
"url": "https://bugzilla.suse.com/1011406"
},
{
"category": "external",
"summary": "SUSE Bug 1011421 for CVE-2016-7426",
"url": "https://bugzilla.suse.com/1011421"
},
{
"category": "external",
"summary": "SUSE Bug 1012330 for CVE-2016-7426",
"url": "https://bugzilla.suse.com/1012330"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "low"
}
],
"title": "CVE-2016-7426"
},
{
"cve": "CVE-2016-7427",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-7427"
}
],
"notes": [
{
"category": "general",
"text": "The broadcast mode replay prevention functionality in ntpd in NTP before 4.2.8p9 allows remote attackers to cause a denial of service (reject broadcast mode packets) via a crafted broadcast mode packet.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-7427",
"url": "https://www.suse.com/security/cve/CVE-2016-7427"
},
{
"category": "external",
"summary": "SUSE Bug 1011390 for CVE-2016-7427",
"url": "https://bugzilla.suse.com/1011390"
},
{
"category": "external",
"summary": "SUSE Bug 1011421 for CVE-2016-7427",
"url": "https://bugzilla.suse.com/1011421"
},
{
"category": "external",
"summary": "SUSE Bug 1012330 for CVE-2016-7427",
"url": "https://bugzilla.suse.com/1012330"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "low"
}
],
"title": "CVE-2016-7427"
},
{
"cve": "CVE-2016-7428",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-7428"
}
],
"notes": [
{
"category": "general",
"text": "ntpd in NTP before 4.2.8p9 allows remote attackers to cause a denial of service (reject broadcast mode packets) via the poll interval in a broadcast packet.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-7428",
"url": "https://www.suse.com/security/cve/CVE-2016-7428"
},
{
"category": "external",
"summary": "SUSE Bug 1011417 for CVE-2016-7428",
"url": "https://bugzilla.suse.com/1011417"
},
{
"category": "external",
"summary": "SUSE Bug 1011421 for CVE-2016-7428",
"url": "https://bugzilla.suse.com/1011421"
},
{
"category": "external",
"summary": "SUSE Bug 1012330 for CVE-2016-7428",
"url": "https://bugzilla.suse.com/1012330"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2016-7428"
},
{
"cve": "CVE-2016-7429",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-7429"
}
],
"notes": [
{
"category": "general",
"text": "NTP before 4.2.8p9 changes the peer structure to the interface it receives the response from a source, which allows remote attackers to cause a denial of service (prevent communication with a source) by sending a response for a source to an interface the source does not use.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-7429",
"url": "https://www.suse.com/security/cve/CVE-2016-7429"
},
{
"category": "external",
"summary": "SUSE Bug 1011404 for CVE-2016-7429",
"url": "https://bugzilla.suse.com/1011404"
},
{
"category": "external",
"summary": "SUSE Bug 1011421 for CVE-2016-7429",
"url": "https://bugzilla.suse.com/1011421"
},
{
"category": "external",
"summary": "SUSE Bug 1012330 for CVE-2016-7429",
"url": "https://bugzilla.suse.com/1012330"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "low"
}
],
"title": "CVE-2016-7429"
},
{
"cve": "CVE-2016-7431",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-7431"
}
],
"notes": [
{
"category": "general",
"text": "NTP before 4.2.8p9 allows remote attackers to bypass the origin timestamp protection mechanism via an origin timestamp of zero. NOTE: this vulnerability exists because of a CVE-2015-8138 regression.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-7431",
"url": "https://www.suse.com/security/cve/CVE-2016-7431"
},
{
"category": "external",
"summary": "SUSE Bug 1011395 for CVE-2016-7431",
"url": "https://bugzilla.suse.com/1011395"
},
{
"category": "external",
"summary": "SUSE Bug 1011421 for CVE-2016-7431",
"url": "https://bugzilla.suse.com/1011421"
},
{
"category": "external",
"summary": "SUSE Bug 1012330 for CVE-2016-7431",
"url": "https://bugzilla.suse.com/1012330"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2016-7431"
},
{
"cve": "CVE-2016-7433",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-7433"
}
],
"notes": [
{
"category": "general",
"text": "NTP before 4.2.8p9 does not properly perform the initial sync calculations, which allows remote attackers to unspecified impact via unknown vectors, related to a \"root distance that did not include the peer dispersion.\"",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-7433",
"url": "https://www.suse.com/security/cve/CVE-2016-7433"
},
{
"category": "external",
"summary": "SUSE Bug 1011411 for CVE-2016-7433",
"url": "https://bugzilla.suse.com/1011411"
},
{
"category": "external",
"summary": "SUSE Bug 1011421 for CVE-2016-7433",
"url": "https://bugzilla.suse.com/1011421"
},
{
"category": "external",
"summary": "SUSE Bug 1012330 for CVE-2016-7433",
"url": "https://bugzilla.suse.com/1012330"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "low"
}
],
"title": "CVE-2016-7433"
},
{
"cve": "CVE-2016-7434",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-7434"
}
],
"notes": [
{
"category": "general",
"text": "The read_mru_list function in NTP before 4.2.8p9 allows remote attackers to cause a denial of service (crash) via a crafted mrulist query.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-7434",
"url": "https://www.suse.com/security/cve/CVE-2016-7434"
},
{
"category": "external",
"summary": "SUSE Bug 1011398 for CVE-2016-7434",
"url": "https://bugzilla.suse.com/1011398"
},
{
"category": "external",
"summary": "SUSE Bug 1011421 for CVE-2016-7434",
"url": "https://bugzilla.suse.com/1011421"
},
{
"category": "external",
"summary": "SUSE Bug 1012330 for CVE-2016-7434",
"url": "https://bugzilla.suse.com/1012330"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2016-7434"
},
{
"cve": "CVE-2016-9310",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-9310"
}
],
"notes": [
{
"category": "general",
"text": "The control mode (mode 6) functionality in ntpd in NTP before 4.2.8p9 allows remote attackers to set or unset traps via a crafted control mode packet.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-9310",
"url": "https://www.suse.com/security/cve/CVE-2016-9310"
},
{
"category": "external",
"summary": "SUSE Bug 1011377 for CVE-2016-9310",
"url": "https://bugzilla.suse.com/1011377"
},
{
"category": "external",
"summary": "SUSE Bug 1011421 for CVE-2016-9310",
"url": "https://bugzilla.suse.com/1011421"
},
{
"category": "external",
"summary": "SUSE Bug 1012330 for CVE-2016-9310",
"url": "https://bugzilla.suse.com/1012330"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2016-9310"
},
{
"cve": "CVE-2016-9311",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-9311"
}
],
"notes": [
{
"category": "general",
"text": "ntpd in NTP before 4.2.8p9, when the trap service is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted packet.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-9311",
"url": "https://www.suse.com/security/cve/CVE-2016-9311"
},
{
"category": "external",
"summary": "SUSE Bug 1011377 for CVE-2016-9311",
"url": "https://bugzilla.suse.com/1011377"
},
{
"category": "external",
"summary": "SUSE Bug 1011421 for CVE-2016-9311",
"url": "https://bugzilla.suse.com/1011421"
},
{
"category": "external",
"summary": "SUSE Bug 1012330 for CVE-2016-9311",
"url": "https://bugzilla.suse.com/1012330"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p9-1.1.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p9-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2016-9311"
}
]
}
CERTA-2009-AVI-195
Vulnerability from certfr_avis
Des vulnérabilités ont été identifiées dans le démon en charge de la maintenance et la synchronisation de l'heure ntpd. Elles peuvent être exploitées à distance par le biais de trames spécialement construites afin de perturber le service, voire d'exécuter du code arbitraire.
Description
Des vulnérabilités ont été identifiées dans le démon en charge de la maintenance et la synchronisation de l'heure ntpd.
- l'une d'elles fonctionne lorsque l'authentification NTP est activée (support OpenSSL). Des requêtes spécialement construites peuvent être incorrectement manipulées par la fonction crypto_rcv() de ntpd/ntp_crypto.c lorsque l'option autokey est utilisée (cette option est visible dans le fichier de configuration ntp.conf avec la présence de la ligne contenant "crypto pw XXX") ;
- des réponses provoquées par l'utilisation de la commande de diagnostic ntpq ne seraient pas correctement manipulées.
Ces vulnérabilités peuvent être exploitées à distance par le biais de trames spécialement construites afin de perturber le service, voire d'exécuter du code arbitraire.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Les versions de ntp antérieures à 4.2.4p7.
Impacted products
| Vendor | Product | Description |
|---|
References
| Title | Publication Time | Tags | |||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [],
"affected_systems_content": "\u003cP\u003eLes versions de ntp ant\u00e9rieures \u00e0 4.2.4p7.\u003c/P\u003e",
"content": "## Description\n\nDes vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 identifi\u00e9es dans le d\u00e9mon en charge de la\nmaintenance et la synchronisation de l\u0027heure ntpd.\n\n- l\u0027une d\u0027elles fonctionne lorsque l\u0027authentification NTP est activ\u00e9e\n (support OpenSSL). Des requ\u00eates sp\u00e9cialement construites peuvent\n \u00eatre incorrectement manipul\u00e9es par la fonction crypto_rcv() de\n ntpd/ntp_crypto.c lorsque l\u0027option autokey est utilis\u00e9e (cette\n option est visible dans le fichier de configuration ntp.conf avec la\n pr\u00e9sence de la ligne contenant \"crypto pw XXX\")\u00a0;\n- des r\u00e9ponses provoqu\u00e9es par l\u0027utilisation de la commande de\n diagnostic ntpq ne seraient pas correctement manipul\u00e9es.\n\nCes vuln\u00e9rabilit\u00e9s peuvent \u00eatre exploit\u00e9es \u00e0 distance par le biais de\ntrames sp\u00e9cialement construites afin de perturber le service, voire\nd\u0027ex\u00e9cuter du code arbitraire.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2009-0159",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0159"
},
{
"name": "CVE-2009-1252",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-1252"
}
],
"initial_release_date": "2009-05-19T00:00:00",
"last_revision_date": "2009-06-11T00:00:00",
"links": [
{
"title": "Bulletin de s\u00e9curit\u00e9 RedHat RHSA-2009:1040 du 18 mai 2009 :",
"url": "http://rhn.redhat.com/errata/RHSA-2009-1040.html"
},
{
"title": "Site officiel de t\u00e9l\u00e9chargement du projet ntp\u00a0:",
"url": "http://www.ntp.org/downloads.html"
},
{
"title": "Note de vuln\u00e9rabilit\u00e9 de l\u0027US-CERT VU#853097 du 18 mai 2009 :",
"url": "http://www.kb.cert.org/vuls/id/853097"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 RedHat RHSA-2009:1039 du 18 mai 2009 :",
"url": "http://rhn.redhat.com/errata/RHSA-2009-1039.html"
},
{
"title": "Site pr\u00e9sentant l\u0027outil de diagnostic ntpq associ\u00e9 \u00e0 ntpd\u00a0:",
"url": "http://www.cis.undel.edu/~mills/ntp/html/ntpq.html"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 FreeBSD SA-09:09.ntpd du 10 juin 2009 :",
"url": "http://security.freebsd.org/advisories/FreeBSD-SA-09:09.ntpd.asc"
}
],
"reference": "CERTA-2009-AVI-195",
"revisions": [
{
"description": "version initiale.",
"revision_date": "2009-05-19T00:00:00.000000"
},
{
"description": "ajout du bulletin de s\u00e9curit\u00e9 FreeBSD.",
"revision_date": "2009-06-11T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
}
],
"summary": "Des vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 identifi\u00e9es dans le d\u00e9mon en charge de la\nmaintenance et la synchronisation de l\u0027heure ntpd. Elles peuvent \u00eatre\nexploit\u00e9es \u00e0 distance par le biais de trames sp\u00e9cialement construites\nafin de perturber le service, voire d\u0027ex\u00e9cuter du code arbitraire.\n",
"title": "Vuln\u00e9rabilit\u00e9s dans ntpd",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Red Hat RHSA-2009-1039 du 18 mai 2009",
"url": null
}
]
}
CERTA-2009-AVI-292
Vulnerability from certfr_avis
Deux vulnérabilités découvertes dans la mise en œuvre du service NTP dans HP-UX permettent à un utilisateur malintentionné de provoquer un déni de service ou d'exécuter du code arbitraire à distance.
Description
Une vulnérabilité de type débordement de mémoire est présente dans la fonction cookedprint(). Elle peut être exploitée au moyen d'un paquet spécialement construit afin de provoquer un déni de service ou d'exécuter du code arbitraire.
Une seconde vulnérabilité de type débordement de mémoire présente dans la fonction crypto_recv() peut être exploitée à distance au moyen d'un paquet spécialement construit envoyé au démon xntpd.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneReferences
| Title | Publication Time | Tags | |
|---|---|---|---|
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "HP-UX 11.x.",
"product": {
"name": "N/A",
"vendor": {
"name": "N/A",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Description\n\nUne vuln\u00e9rabilit\u00e9 de type d\u00e9bordement de m\u00e9moire est pr\u00e9sente dans la\nfonction cookedprint(). Elle peut \u00eatre exploit\u00e9e au moyen d\u0027un paquet\nsp\u00e9cialement construit afin de provoquer un d\u00e9ni de service ou\nd\u0027ex\u00e9cuter du code arbitraire.\n\nUne seconde vuln\u00e9rabilit\u00e9 de type d\u00e9bordement de m\u00e9moire pr\u00e9sente dans\nla fonction crypto_recv() peut \u00eatre exploit\u00e9e \u00e0 distance au moyen d\u0027un\npaquet sp\u00e9cialement construit envoy\u00e9 au d\u00e9mon xntpd.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2009-0159",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0159"
},
{
"name": "CVE-2009-1252",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-1252"
}
],
"initial_release_date": "2009-07-27T00:00:00",
"last_revision_date": "2010-03-26T00:00:00",
"links": [
{
"title": "Avis de s\u00e9curit\u00e9 CERTA-2009-AVI-195 du 19 mai 2009 :",
"url": "http://www.certa.ssi.gouv.fr/site/CERTA-2009-AVI-195/CERTA-2009-AVI-195.html"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 HP #c01961959 du 23 mars 2010 :",
"url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document/.jsp?objectID=c01961959"
}
],
"reference": "CERTA-2009-AVI-292",
"revisions": [
{
"description": "version initiale.",
"revision_date": "2009-07-27T00:00:00.000000"
},
{
"description": "ajout de la r\u00e9f\u00e9rence au bulletin de s\u00e9curit\u00e9 HP #01961959.",
"revision_date": "2010-03-26T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
}
],
"summary": "Deux vuln\u00e9rabilit\u00e9s d\u00e9couvertes dans la mise en \u0153uvre du service NTP\ndans HP-UX permettent \u00e0 un utilisateur malintentionn\u00e9 de provoquer un\nd\u00e9ni de service ou d\u0027ex\u00e9cuter du code arbitraire \u00e0 distance.\n",
"title": "Vuln\u00e9rabilit\u00e9s dans HP-UX",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 HP #c01763606 du 21 juillet 2009",
"url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document/.jsp?objectID=c01763606"
}
]
}
CERTFR-2014-AVI-480
Vulnerability from certfr_avis
De multiples vulnérabilités ont été corrigées dans les produits Juniper. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une exécution de code arbitraire et un déni de service à distance.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Juniper Networks | N/A | CTPOS versions antérieures à 6.6R2 | ||
| ESET | Security | Juniper Security Threat Response Manager versions 2012.1, 2013.1, 2013.2 | ||
| Juniper Networks | N/A | CTPView versions 4.2, 4.3, 4.4, 4.5, 4.6 | ||
| Juniper Networks | Junos Space | Junos Space jusqu'à la version 13.3 | ||
| Juniper Networks | Secure Analytics | Juniper Secure Analytics versions 2013.2, 2014.1, 2014.2 | ||
| ESET | Security | Network and Security Manager (NSM) version 2012.2 |
References
| Title | Publication Time | Tags | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "CTPOS versions ant\u00e9rieures \u00e0 6.6R2",
"product": {
"name": "N/A",
"vendor": {
"name": "Juniper Networks",
"scada": false
}
}
},
{
"description": "Juniper Security Threat Response Manager versions 2012.1, 2013.1, 2013.2",
"product": {
"name": "Security",
"vendor": {
"name": "ESET",
"scada": false
}
}
},
{
"description": "CTPView versions 4.2, 4.3, 4.4, 4.5, 4.6",
"product": {
"name": "N/A",
"vendor": {
"name": "Juniper Networks",
"scada": false
}
}
},
{
"description": "Junos Space jusqu\u0027\u00e0 la version 13.3",
"product": {
"name": "Junos Space",
"vendor": {
"name": "Juniper Networks",
"scada": false
}
}
},
{
"description": "Juniper Secure Analytics versions 2013.2, 2014.1, 2014.2",
"product": {
"name": "Secure Analytics",
"vendor": {
"name": "Juniper Networks",
"scada": false
}
}
},
{
"description": "Network and Security Manager (NSM) version 2012.2",
"product": {
"name": "Security",
"vendor": {
"name": "ESET",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2012-3158",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-3158"
},
{
"name": "CVE-2010-3853",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-3853"
},
{
"name": "CVE-2014-0075",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0075"
},
{
"name": "CVE-2010-3081",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-3081"
},
{
"name": "CVE-2012-0789",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-0789"
},
{
"name": "CVE-2012-2329",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-2329"
},
{
"name": "CVE-2014-0460",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0460"
},
{
"name": "CVE-2011-4609",
"url": "https://www.cve.org/CVERecord?id=CVE-2011-4609"
},
{
"name": "CVE-2011-0421",
"url": "https://www.cve.org/CVERecord?id=CVE-2011-0421"
},
{
"name": "CVE-2012-0781",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-0781"
},
{
"name": "CVE-2014-4827",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4827"
},
{
"name": "CVE-2013-1635",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-1635"
},
{
"name": "CVE-2011-0216",
"url": "https://www.cve.org/CVERecord?id=CVE-2011-0216"
},
{
"name": "CVE-2013-1620",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-1620"
},
{
"name": "CVE-2014-0119",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0119"
},
{
"name": "CVE-2012-2110",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-2110"
},
{
"name": "CVE-2014-7186",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-7186"
},
{
"name": "CVE-2009-2416",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-2416"
},
{
"name": "CVE-2012-0788",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-0788"
},
{
"name": "CVE-2010-4755",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-4755"
},
{
"name": "CVE-2013-1775",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-1775"
},
{
"name": "CVE-2009-5029",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-5029"
},
{
"name": "CVE-2011-1153",
"url": "https://www.cve.org/CVERecord?id=CVE-2011-1153"
},
{
"name": "CVE-2009-3563",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-3563"
},
{
"name": "CVE-2014-0411",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0411"
},
{
"name": "CVE-2013-1643",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-1643"
},
{
"name": "CVE-2013-0791",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-0791"
},
{
"name": "CVE-2010-1646",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-1646"
},
{
"name": "CVE-2014-7169",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-7169"
},
{
"name": "CVE-2011-1944",
"url": "https://www.cve.org/CVERecord?id=CVE-2011-1944"
},
{
"name": "CVE-2014-0099",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0099"
},
{
"name": "CVE-2011-0010",
"url": "https://www.cve.org/CVERecord?id=CVE-2011-0010"
},
{
"name": "CVE-2011-1398",
"url": "https://www.cve.org/CVERecord?id=CVE-2011-1398"
},
{
"name": "CVE-2011-2834",
"url": "https://www.cve.org/CVERecord?id=CVE-2011-2834"
},
{
"name": "CVE-2014-4825",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4825"
},
{
"name": "CVE-2010-4707",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-4707"
},
{
"name": "CVE-2012-0882",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-0882"
},
{
"name": "CVE-2009-0159",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0159"
},
{
"name": "CVE-2014-0453",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0453"
},
{
"name": "CVE-2011-0708",
"url": "https://www.cve.org/CVERecord?id=CVE-2011-0708"
},
{
"name": "CVE-2014-6271",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-6271"
},
{
"name": "CVE-2014-6277",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-6277"
},
{
"name": "CVE-2014-1568",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-1568"
},
{
"name": "CVE-2010-0830",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0830"
},
{
"name": "CVE-2010-0426",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0426"
},
{
"name": "CVE-2014-0423",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0423"
},
{
"name": "CVE-2012-2311",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-2311"
},
{
"name": "CVE-2014-0224",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0224"
},
{
"name": "CVE-2014-4830",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4830"
},
{
"name": "CVE-2011-3368",
"url": "https://www.cve.org/CVERecord?id=CVE-2011-3368"
},
{
"name": "CVE-2014-2532",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-2532"
},
{
"name": "CVE-2014-4828",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4828"
},
{
"name": "CVE-2014-0095",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0095"
},
{
"name": "CVE-2010-0427",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0427"
},
{
"name": "CVE-2014-3470",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3470"
},
{
"name": "CVE-2014-3062",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3062"
},
{
"name": "CVE-2012-0831",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-0831"
},
{
"name": "CVE-2009-2414",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-2414"
},
{
"name": "CVE-2012-0057",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-0057"
},
{
"name": "CVE-2014-7187",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-7187"
},
{
"name": "CVE-2010-2956",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-2956"
},
{
"name": "CVE-2011-3905",
"url": "https://www.cve.org/CVERecord?id=CVE-2011-3905"
},
{
"name": "CVE-2014-4833",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4833"
},
{
"name": "CVE-2011-4566",
"url": "https://www.cve.org/CVERecord?id=CVE-2011-4566"
},
{
"name": "CVE-2014-0837",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0837"
},
{
"name": "CVE-2010-4008",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-4008"
},
{
"name": "CVE-2014-6278",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-6278"
},
{
"name": "CVE-2012-1172",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-1172"
},
{
"name": "CVE-2014-0076",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0076"
},
{
"name": "CVE-2010-1163",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-1163"
},
{
"name": "CVE-2011-4317",
"url": "https://www.cve.org/CVERecord?id=CVE-2011-4317"
},
{
"name": "CVE-2011-4885",
"url": "https://www.cve.org/CVERecord?id=CVE-2011-4885"
},
{
"name": "CVE-2010-5107",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-5107"
},
{
"name": "CVE-2009-1265",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-1265"
},
{
"name": "CVE-2010-3316",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-3316"
},
{
"name": "CVE-2012-3510",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-3510"
},
{
"name": "CVE-2011-5000",
"url": "https://www.cve.org/CVERecord?id=CVE-2011-5000"
},
{
"name": "CVE-2010-3435",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-3435"
},
{
"name": "CVE-2011-3919",
"url": "https://www.cve.org/CVERecord?id=CVE-2011-3919"
},
{
"name": "CVE-2012-2337",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-2337"
},
{
"name": "CVE-2011-1089",
"url": "https://www.cve.org/CVERecord?id=CVE-2011-1089"
},
{
"name": "CVE-2014-0096",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0096"
},
{
"name": "CVE-2013-5908",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-5908"
},
{
"name": "CVE-2014-3091",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3091"
},
{
"name": "CVE-2012-2131",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-2131"
}
],
"initial_release_date": "2014-11-13T00:00:00",
"last_revision_date": "2014-11-13T00:00:00",
"links": [],
"reference": "CERTFR-2014-AVI-480",
"revisions": [
{
"description": "version initiale.",
"revision_date": "2014-11-13T00:00:00.000000"
}
],
"risks": [
{
"description": "Injection de code indirecte \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
},
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "D\u00e9ni de service"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans les produits \u003cspan\nclass=\"textit\"\u003eJuniper\u003c/span\u003e. Certaines d\u0027entre elles permettent \u00e0 un\nattaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une\nex\u00e9cution de code arbitraire et un d\u00e9ni de service \u00e0 distance.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Juniper",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Juniper JSA10661 du 11 novembre 2014",
"url": "http://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA10661"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Juniper JSA10657 du 11 novembre 2014",
"url": "http://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA10657"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Juniper JSA10658 du 11 novembre 2014",
"url": "http://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA10658"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Juniper JSA10659 du 11 novembre 2014",
"url": "http://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA10659"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Juniper JSA10660 du 11 novembre 2014",
"url": "http://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA10660"
}
]
}
CERTA-2009-AVI-513
Vulnerability from certfr_avis
Plusieurs vulnérabilités découvertes dans les produits VMware peuvent être exploitées à distance par un utilisateur malintentionné afin de compromettre le système vulnérable ou encore d'entraver son bon fonctionnement.
Description
Les vulnérabilités présentes dans les produits VMware peuvent être exploitées afin de porter atteinte à l'intégrité et à la confidentialité des données, de réaliser un déni de service, d'injecter et d'exécuter indirectement du code arbitraire, d'élever ses privilèges ou d'exécuter du code arbitraire.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| VMware | N/A | VMware Server 2.x ; | ||
| VMware | ESXi | VMware ESXi 3.x ; | ||
| VMware | N/A | VMware vMA 4.x. | ||
| VMware | N/A | VMware ESX Server 4.x ; | ||
| VMware | N/A | VMware ESX Server 2.x ; | ||
| VMware | N/A | VMware ESX Server 3.x ; | ||
| VMware | ESXi | VMware ESXi 4.x ; | ||
| VMware | vCenter Server | VMware vCenter Server 4.x ; | ||
| VMware | N/A | VMware VirtualCenter 2.x ; |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "VMware Server 2.x ;",
"product": {
"name": "N/A",
"vendor": {
"name": "VMware",
"scada": false
}
}
},
{
"description": "VMware ESXi 3.x ;",
"product": {
"name": "ESXi",
"vendor": {
"name": "VMware",
"scada": false
}
}
},
{
"description": "VMware vMA 4.x.",
"product": {
"name": "N/A",
"vendor": {
"name": "VMware",
"scada": false
}
}
},
{
"description": "VMware ESX Server 4.x ;",
"product": {
"name": "N/A",
"vendor": {
"name": "VMware",
"scada": false
}
}
},
{
"description": "VMware ESX Server 2.x ;",
"product": {
"name": "N/A",
"vendor": {
"name": "VMware",
"scada": false
}
}
},
{
"description": "VMware ESX Server 3.x ;",
"product": {
"name": "N/A",
"vendor": {
"name": "VMware",
"scada": false
}
}
},
{
"description": "VMware ESXi 4.x ;",
"product": {
"name": "ESXi",
"vendor": {
"name": "VMware",
"scada": false
}
}
},
{
"description": "VMware vCenter Server 4.x ;",
"product": {
"name": "vCenter Server",
"vendor": {
"name": "VMware",
"scada": false
}
}
},
{
"description": "VMware VirtualCenter 2.x ;",
"product": {
"name": "N/A",
"vendor": {
"name": "VMware",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Description\n\nLes vuln\u00e9rabilit\u00e9s pr\u00e9sentes dans les produits VMware peuvent \u00eatre\nexploit\u00e9es afin de porter atteinte \u00e0 l\u0027int\u00e9grit\u00e9 et \u00e0 la confidentialit\u00e9\ndes donn\u00e9es, de r\u00e9aliser un d\u00e9ni de service, d\u0027injecter et d\u0027ex\u00e9cuter\nindirectement du code arbitraire, d\u0027\u00e9lever ses privil\u00e8ges ou d\u0027ex\u00e9cuter\ndu code arbitraire.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2009-2724",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-2724"
},
{
"name": "CVE-2009-0676",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0676"
},
{
"name": "CVE-2009-2721",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-2721"
},
{
"name": "CVE-2008-3143",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-3143"
},
{
"name": "CVE-2009-2692",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-2692"
},
{
"name": "CVE-2009-2406",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-2406"
},
{
"name": "CVE-2009-1389",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-1389"
},
{
"name": "CVE-2008-0002",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-0002"
},
{
"name": "CVE-2009-1106",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-1106"
},
{
"name": "CVE-2009-1072",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-1072"
},
{
"name": "CVE-2008-4307",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-4307"
},
{
"name": "CVE-2009-1104",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-1104"
},
{
"name": "CVE-2009-2407",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-2407"
},
{
"name": "CVE-2008-3142",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-3142"
},
{
"name": "CVE-2009-1101",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-1101"
},
{
"name": "CVE-2009-2416",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-2416"
},
{
"name": "CVE-2009-1385",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-1385"
},
{
"name": "CVE-2009-0746",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0746"
},
{
"name": "CVE-2009-2673",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-2673"
},
{
"name": "CVE-2007-5966",
"url": "https://www.cve.org/CVERecord?id=CVE-2007-5966"
},
{
"name": "CVE-2009-2719",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-2719"
},
{
"name": "CVE-2008-4864",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-4864"
},
{
"name": "CVE-2009-2417",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-2417"
},
{
"name": "CVE-2009-1439",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-1439"
},
{
"name": "CVE-2009-0322",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0322"
},
{
"name": "CVE-2009-1895",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-1895"
},
{
"name": "CVE-2009-1094",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-1094"
},
{
"name": "CVE-2009-0748",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0748"
},
{
"name": "CVE-2008-3144",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-3144"
},
{
"name": "CVE-2009-0747",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0747"
},
{
"name": "CVE-2009-0580",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0580"
},
{
"name": "CVE-2009-1095",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-1095"
},
{
"name": "CVE-2009-2672",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-2672"
},
{
"name": "CVE-2009-0675",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0675"
},
{
"name": "CVE-2007-5461",
"url": "https://www.cve.org/CVERecord?id=CVE-2007-5461"
},
{
"name": "CVE-2009-2670",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-2670"
},
{
"name": "CVE-2009-1102",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-1102"
},
{
"name": "CVE-2009-1630",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-1630"
},
{
"name": "CVE-2009-0269",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0269"
},
{
"name": "CVE-2008-3528",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-3528"
},
{
"name": "CVE-2008-5031",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-5031"
},
{
"name": "CVE-2008-1721",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-1721"
},
{
"name": "CVE-2009-1388",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-1388"
},
{
"name": "CVE-2009-1192",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-1192"
},
{
"name": "CVE-2009-2720",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-2720"
},
{
"name": "CVE-2009-0834",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0834"
},
{
"name": "CVE-2009-2671",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-2671"
},
{
"name": "CVE-2009-2848",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-2848"
},
{
"name": "CVE-2009-2675",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-2675"
},
{
"name": "CVE-2008-1232",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-1232"
},
{
"name": "CVE-2009-0159",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0159"
},
{
"name": "CVE-2009-0778",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0778"
},
{
"name": "CVE-2009-2625",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-2625"
},
{
"name": "CVE-2009-1099",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-1099"
},
{
"name": "CVE-2009-1252",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-1252"
},
{
"name": "CVE-2009-2698",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-2698"
},
{
"name": "CVE-2008-2370",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-2370"
},
{
"name": "CVE-2009-0033",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0033"
},
{
"name": "CVE-2009-2723",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-2723"
},
{
"name": "CVE-2009-1107",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-1107"
},
{
"name": "CVE-2009-2716",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-2716"
},
{
"name": "CVE-2007-5333",
"url": "https://www.cve.org/CVERecord?id=CVE-2007-5333"
},
{
"name": "CVE-2008-1947",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-1947"
},
{
"name": "CVE-2009-1105",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-1105"
},
{
"name": "CVE-2007-6286",
"url": "https://www.cve.org/CVERecord?id=CVE-2007-6286"
},
{
"name": "CVE-2009-0028",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0028"
},
{
"name": "CVE-2009-1337",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-1337"
},
{
"name": "CVE-2009-0781",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0781"
},
{
"name": "CVE-2009-2414",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-2414"
},
{
"name": "CVE-2007-2052",
"url": "https://www.cve.org/CVERecord?id=CVE-2007-2052"
},
{
"name": "CVE-2009-1336",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-1336"
},
{
"name": "CVE-2009-0783",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0783"
},
{
"name": "CVE-2008-5515",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-5515"
},
{
"name": "CVE-2007-4965",
"url": "https://www.cve.org/CVERecord?id=CVE-2007-4965"
},
{
"name": "CVE-2009-1633",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-1633"
},
{
"name": "CVE-2009-2722",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-2722"
},
{
"name": "CVE-2008-5700",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-5700"
},
{
"name": "CVE-2009-1103",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-1103"
},
{
"name": "CVE-2009-1100",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-1100"
},
{
"name": "CVE-2009-2676",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-2676"
},
{
"name": "CVE-2007-5342",
"url": "https://www.cve.org/CVERecord?id=CVE-2007-5342"
},
{
"name": "CVE-2009-1096",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-1096"
},
{
"name": "CVE-2009-1098",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-1098"
},
{
"name": "CVE-2009-0787",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0787"
},
{
"name": "CVE-2008-1887",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-1887"
},
{
"name": "CVE-2009-1097",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-1097"
},
{
"name": "CVE-2009-2847",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-2847"
},
{
"name": "CVE-2008-2315",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-2315"
},
{
"name": "CVE-2009-0696",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0696"
},
{
"name": "CVE-2009-2718",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-2718"
},
{
"name": "CVE-2009-0745",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0745"
},
{
"name": "CVE-2009-1093",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-1093"
}
],
"initial_release_date": "2009-11-24T00:00:00",
"last_revision_date": "2009-11-24T00:00:00",
"links": [],
"reference": "CERTA-2009-AVI-513",
"revisions": [
{
"description": "version initiale.",
"revision_date": "2009-11-24T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de code indirecte"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "Plusieurs vuln\u00e9rabilit\u00e9s d\u00e9couvertes dans les produits VMware peuvent\n\u00eatre exploit\u00e9es \u00e0 distance par un utilisateur malintentionn\u00e9 afin de\ncompromettre le syst\u00e8me vuln\u00e9rable ou encore d\u0027entraver son bon\nfonctionnement.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits VMware",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 VMware du 20 novembre 2009",
"url": "http://lists.vmware.com/pipermail/security-announce/2009/000070.html"
}
]
}
CERTA-2009-AVI-186
Vulnerability from certfr_avis
Plusieurs vulnérabilités ont été identifiées dans le système d'exploitation Apple Mac OS X. L'exploitation de certaines d'entre elles peut conduire à l'exécution de code arbitraire à distance sur le système vulnérable.
Description
Plusieurs vulnérabilités ont été identifiées dans le système d'exploitation Apple Mac OS X. Elles touchent divers composants et services installés comme CFNetworks (manipulation des échanges HTTP), CoreGraphics (manipulation de fichiers PDF), Help Viewer (manipulation de l'URI help:), QuickDraw Manager (manipulation d'images PICT), Safari (manipulation de l'URI feed:), OpenSSL, PHP, WebKit, X11, etc.
L'exploitation de certaines de ces vulnérabilités peut conduire à l'exécution de code arbitraire à distance sur le système vulnérable.
Solution
Se référer au bulletin de sécurité 2009-002 de Apple pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Apple | N/A | Mac OS X Server version 10.4.11 ainsi que celles antérieures. | ||
| Apple | N/A | Mac OS X Server version 10.5.6 ainsi que celles antérieures ; | ||
| Apple | N/A | Mac OS X version 10.5.6 ainsi que celles antérieures ; | ||
| Apple | N/A | Mac OS X version 10.4.11 ainsi que celles antérieures ; |
References
| Title | Publication Time | Tags | |
|---|---|---|---|
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Mac OS X Server version 10.4.11 ainsi que celles ant\u00e9rieures.",
"product": {
"name": "N/A",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "Mac OS X Server version 10.5.6 ainsi que celles ant\u00e9rieures ;",
"product": {
"name": "N/A",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "Mac OS X version 10.5.6 ainsi que celles ant\u00e9rieures ;",
"product": {
"name": "N/A",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "Mac OS X version 10.4.11 ainsi que celles ant\u00e9rieures ;",
"product": {
"name": "N/A",
"vendor": {
"name": "Apple",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Description\n\nPlusieurs vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 identifi\u00e9es dans le syst\u00e8me\nd\u0027exploitation Apple Mac OS X. Elles touchent divers composants et\nservices install\u00e9s comme CFNetworks (manipulation des \u00e9changes HTTP),\nCoreGraphics (manipulation de fichiers PDF), Help Viewer (manipulation\nde l\u0027URI help:), QuickDraw Manager (manipulation d\u0027images PICT), Safari\n(manipulation de l\u0027URI feed:), OpenSSL, PHP, WebKit, X11, etc.\n\nL\u0027exploitation de certaines de ces vuln\u00e9rabilit\u00e9s peut conduire \u00e0\nl\u0027ex\u00e9cution de code arbitraire \u00e0 distance sur le syst\u00e8me vuln\u00e9rable.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 2009-002 de Apple pour l\u0027obtention\ndes correctifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2009-0160",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0160"
},
{
"name": "CVE-2009-0147",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0147"
},
{
"name": "CVE-2008-3652",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-3652"
},
{
"name": "CVE-2009-0846",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0846"
},
{
"name": "CVE-2008-5557",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-5557"
},
{
"name": "CVE-2009-0847",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0847"
},
{
"name": "CVE-2009-0155",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0155"
},
{
"name": "CVE-2008-3657",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-3657"
},
{
"name": "CVE-2009-0153",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0153"
},
{
"name": "CVE-2008-1517",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-1517"
},
{
"name": "CVE-2008-3660",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-3660"
},
{
"name": "CVE-2008-3529",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-3529"
},
{
"name": "CVE-2008-0456",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-0456"
},
{
"name": "CVE-2009-0943",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0943"
},
{
"name": "CVE-2009-0157",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0157"
},
{
"name": "CVE-2008-3651",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-3651"
},
{
"name": "CVE-2009-0010",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0010"
},
{
"name": "CVE-2009-0040",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0040"
},
{
"name": "CVE-2008-1382",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-1382"
},
{
"name": "CVE-2004-1185",
"url": "https://www.cve.org/CVERecord?id=CVE-2004-1185"
},
{
"name": "CVE-2009-0148",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0148"
},
{
"name": "CVE-2008-2371",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-2371"
},
{
"name": "CVE-2008-3658",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-3658"
},
{
"name": "CVE-2008-3443",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-3443"
},
{
"name": "CVE-2008-3659",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-3659"
},
{
"name": "CVE-2009-0025",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0025"
},
{
"name": "CVE-2008-3863",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-3863"
},
{
"name": "CVE-2008-2383",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-2383"
},
{
"name": "CVE-2008-3530",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-3530"
},
{
"name": "CVE-2009-0149",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0149"
},
{
"name": "CVE-2009-0154",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0154"
},
{
"name": "CVE-2008-3790",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-3790"
},
{
"name": "CVE-2009-0159",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0159"
},
{
"name": "CVE-2008-2829",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-2829"
},
{
"name": "CVE-2009-0165",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0165"
},
{
"name": "CVE-2009-0144",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0144"
},
{
"name": "CVE-2009-0162",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0162"
},
{
"name": "CVE-2008-3655",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-3655"
},
{
"name": "CVE-2004-1186",
"url": "https://www.cve.org/CVERecord?id=CVE-2004-1186"
},
{
"name": "CVE-2008-2665",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-2665"
},
{
"name": "CVE-2009-0114",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0114"
},
{
"name": "CVE-2008-2666",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-2666"
},
{
"name": "CVE-2009-0021",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0021"
},
{
"name": "CVE-2009-0519",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0519"
},
{
"name": "CVE-2009-0145",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0145"
},
{
"name": "CVE-2008-3656",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-3656"
},
{
"name": "CVE-2009-0146",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0146"
},
{
"name": "CVE-2009-0844",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0844"
},
{
"name": "CVE-2009-0942",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0942"
},
{
"name": "CVE-2009-0152",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0152"
},
{
"name": "CVE-2009-0156",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0156"
},
{
"name": "CVE-2009-0946",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0946"
},
{
"name": "CVE-2009-0150",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0150"
},
{
"name": "CVE-2008-4309",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-4309"
},
{
"name": "CVE-2007-2754",
"url": "https://www.cve.org/CVERecord?id=CVE-2007-2754"
},
{
"name": "CVE-2009-0845",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0845"
},
{
"name": "CVE-2009-0944",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0944"
},
{
"name": "CVE-2009-0164",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0164"
},
{
"name": "CVE-2009-0520",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0520"
},
{
"name": "CVE-2008-2939",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-2939"
},
{
"name": "CVE-2009-0161",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0161"
},
{
"name": "CVE-2008-0158",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-0158"
},
{
"name": "CVE-2004-1184",
"url": "https://www.cve.org/CVERecord?id=CVE-2004-1184"
},
{
"name": "CVE-2008-5077",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-5077"
},
{
"name": "CVE-2006-0747",
"url": "https://www.cve.org/CVERecord?id=CVE-2006-0747"
},
{
"name": "CVE-2009-0945",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0945"
}
],
"initial_release_date": "2009-05-13T00:00:00",
"last_revision_date": "2009-05-13T00:00:00",
"links": [
{
"title": "D\u00e9tails concernant la mise \u00e0 jour de s\u00e9curit\u00e9 2009-002 du 12 mai 2009\u00a0:",
"url": "http://support.apple.com/kb/HT3397"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Apple 61798 du 12 mai 2009 :",
"url": "http://docs.info.apple.com/article.html?artnum=61798"
},
{
"title": "D\u00e9tails concernant la mise \u00e0 jour de s\u00e9curit\u00e9 2009-002 du 12 mai 2009\u00a0:",
"url": "http://support.apple.com/kb/HT3549"
}
],
"reference": "CERTA-2009-AVI-186",
"revisions": [
{
"description": "version initiale.",
"revision_date": "2009-05-13T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de code indirecte"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
}
],
"summary": "Plusieurs vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 identifi\u00e9es dans le syst\u00e8me\nd\u0027exploitation Apple Mac OS X. L\u0027exploitation de certaines d\u0027entre elles\npeut conduire \u00e0 l\u0027ex\u00e9cution de code arbitraire \u00e0 distance sur le syst\u00e8me\nvuln\u00e9rable.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Apple Mac OS X",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 2009-002 Apple du 12 mai 2009",
"url": null
}
]
}
fkie_cve-2009-0159
Vulnerability from fkie_nvd
Published
2009-04-14 15:30
Modified
2025-04-09 00:30
Severity ?
Summary
Stack-based buffer overflow in the cookedprint function in ntpq/ntpq.c in ntpq in NTP before 4.2.4p7-RC2 allows remote NTP servers to execute arbitrary code via a crafted response.
References
| URL | Tags | ||
|---|---|---|---|
| cve@mitre.org | ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-006.txt.asc | ||
| cve@mitre.org | http://bugs.pardus.org.tr/show_bug.cgi?id=9532 | ||
| cve@mitre.org | http://lists.apple.com/archives/security-announce/2009/May/msg00002.html | ||
| cve@mitre.org | http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html | ||
| cve@mitre.org | http://marc.info/?l=bugtraq&m=136482797910018&w=2 | ||
| cve@mitre.org | http://marc.info/?l=bugtraq&m=136482797910018&w=2 | ||
| cve@mitre.org | http://ntp.bkbits.net:8080/ntp-stable/?PAGE=gnupatch&REV=1.1565 | ||
| cve@mitre.org | http://osvdb.org/53593 | ||
| cve@mitre.org | http://rhn.redhat.com/errata/RHSA-2009-1039.html | ||
| cve@mitre.org | http://rhn.redhat.com/errata/RHSA-2009-1040.html | ||
| cve@mitre.org | http://secunia.com/advisories/34608 | Vendor Advisory | |
| cve@mitre.org | http://secunia.com/advisories/35074 | Vendor Advisory | |
| cve@mitre.org | http://secunia.com/advisories/35137 | Vendor Advisory | |
| cve@mitre.org | http://secunia.com/advisories/35138 | Vendor Advisory | |
| cve@mitre.org | http://secunia.com/advisories/35166 | Vendor Advisory | |
| cve@mitre.org | http://secunia.com/advisories/35169 | Vendor Advisory | |
| cve@mitre.org | http://secunia.com/advisories/35253 | Vendor Advisory | |
| cve@mitre.org | http://secunia.com/advisories/35308 | Vendor Advisory | |
| cve@mitre.org | http://secunia.com/advisories/35336 | Vendor Advisory | |
| cve@mitre.org | http://secunia.com/advisories/35416 | Vendor Advisory | |
| cve@mitre.org | http://secunia.com/advisories/35630 | Vendor Advisory | |
| cve@mitre.org | http://secunia.com/advisories/37471 | Vendor Advisory | |
| cve@mitre.org | http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.566238 | ||
| cve@mitre.org | http://support.apple.com/kb/HT3549 | ||
| cve@mitre.org | http://www.debian.org/security/2009/dsa-1801 | ||
| cve@mitre.org | http://www.gentoo.org/security/en/glsa/glsa-200905-08.xml | ||
| cve@mitre.org | http://www.mandriva.com/security/advisories?name=MDVSA-2009:092 | ||
| cve@mitre.org | http://www.securityfocus.com/archive/1/507985/100/0/threaded | ||
| cve@mitre.org | http://www.securityfocus.com/bid/34481 | Patch | |
| cve@mitre.org | http://www.securitytracker.com/id?1022033 | ||
| cve@mitre.org | http://www.us-cert.gov/cas/techalerts/TA09-133A.html | US Government Resource | |
| cve@mitre.org | http://www.vmware.com/security/advisories/VMSA-2009-0016.html | ||
| cve@mitre.org | http://www.vupen.com/english/advisories/2009/0999 | Vendor Advisory | |
| cve@mitre.org | http://www.vupen.com/english/advisories/2009/1297 | Vendor Advisory | |
| cve@mitre.org | http://www.vupen.com/english/advisories/2009/3316 | Vendor Advisory | |
| cve@mitre.org | https://bugzilla.redhat.com/show_bug.cgi?id=490617 | ||
| cve@mitre.org | https://exchange.xforce.ibmcloud.com/vulnerabilities/49838 | ||
| cve@mitre.org | https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19392 | ||
| cve@mitre.org | https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5411 | ||
| cve@mitre.org | https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8386 | ||
| cve@mitre.org | https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8665 | ||
| cve@mitre.org | https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9634 | ||
| cve@mitre.org | https://rhn.redhat.com/errata/RHSA-2009-1651.html | ||
| cve@mitre.org | https://support.ntp.org/bugs/show_bug.cgi?id=1144 | Patch | |
| cve@mitre.org | https://usn.ubuntu.com/777-1/ | ||
| cve@mitre.org | https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01414.html | ||
| cve@mitre.org | https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01449.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-006.txt.asc | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://bugs.pardus.org.tr/show_bug.cgi?id=9532 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.apple.com/archives/security-announce/2009/May/msg00002.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://marc.info/?l=bugtraq&m=136482797910018&w=2 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://marc.info/?l=bugtraq&m=136482797910018&w=2 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://ntp.bkbits.net:8080/ntp-stable/?PAGE=gnupatch&REV=1.1565 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://osvdb.org/53593 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://rhn.redhat.com/errata/RHSA-2009-1039.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://rhn.redhat.com/errata/RHSA-2009-1040.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/34608 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/35074 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/35137 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/35138 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/35166 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/35169 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/35253 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/35308 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/35336 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/35416 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/35630 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/37471 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.566238 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://support.apple.com/kb/HT3549 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.debian.org/security/2009/dsa-1801 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.gentoo.org/security/en/glsa/glsa-200905-08.xml | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.mandriva.com/security/advisories?name=MDVSA-2009:092 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/archive/1/507985/100/0/threaded | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/34481 | Patch | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securitytracker.com/id?1022033 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.us-cert.gov/cas/techalerts/TA09-133A.html | US Government Resource | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.vmware.com/security/advisories/VMSA-2009-0016.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.vupen.com/english/advisories/2009/0999 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.vupen.com/english/advisories/2009/1297 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.vupen.com/english/advisories/2009/3316 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://bugzilla.redhat.com/show_bug.cgi?id=490617 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/49838 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19392 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5411 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8386 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8665 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9634 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://rhn.redhat.com/errata/RHSA-2009-1651.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://support.ntp.org/bugs/show_bug.cgi?id=1144 | Patch | |
| af854a3a-2127-422b-91ae-364da2661108 | https://usn.ubuntu.com/777-1/ | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01414.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01449.html |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ntp | ntp | * | |
| ntp | ntp | 4.0.72 | |
| ntp | ntp | 4.0.73 | |
| ntp | ntp | 4.0.90 | |
| ntp | ntp | 4.0.91 | |
| ntp | ntp | 4.0.92 | |
| ntp | ntp | 4.0.93 | |
| ntp | ntp | 4.0.94 | |
| ntp | ntp | 4.0.95 | |
| ntp | ntp | 4.0.96 | |
| ntp | ntp | 4.0.97 | |
| ntp | ntp | 4.0.98 | |
| ntp | ntp | 4.0.99 | |
| ntp | ntp | 4.1.0 | |
| ntp | ntp | 4.1.2 | |
| ntp | ntp | 4.2.0 | |
| ntp | ntp | 4.2.2 | |
| ntp | ntp | 4.2.2p1 | |
| ntp | ntp | 4.2.2p2 | |
| ntp | ntp | 4.2.2p3 | |
| ntp | ntp | 4.2.2p4 | |
| ntp | ntp | 4.2.4 | |
| ntp | ntp | 4.2.4p0 | |
| ntp | ntp | 4.2.4p1 | |
| ntp | ntp | 4.2.4p2 | |
| ntp | ntp | 4.2.4p3 | |
| ntp | ntp | 4.2.4p4 | |
| ntp | ntp | 4.2.4p5 | |
| ntp | ntp | 4.2.4p6 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ntp:ntp:*:rc1:*:*:*:*:*:*",
"matchCriteriaId": "E94AD088-AEF8-4708-9EAE-1A46F7C4DC4E",
"versionEndIncluding": "4.2.4p7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.0.72:*:*:*:*:*:*:*",
"matchCriteriaId": "25AB2D70-2807-4970-ACD3-9B4751A1F9D6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.0.73:*:*:*:*:*:*:*",
"matchCriteriaId": "06C78C19-5A09-4883-8144-AE861A244FEA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.0.90:*:*:*:*:*:*:*",
"matchCriteriaId": "437C8BA8-F437-4166-838D-EDC64E7A67DC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.0.91:*:*:*:*:*:*:*",
"matchCriteriaId": "104AEC97-3C2A-48D2-BA63-08502F88F8D2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.0.92:*:*:*:*:*:*:*",
"matchCriteriaId": "87D67E30-E303-4F79-9929-4A5B587FCDB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.0.93:*:*:*:*:*:*:*",
"matchCriteriaId": "B9BD95B5-322C-4CDC-A2DB-A06D4DA3B104",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.0.94:*:*:*:*:*:*:*",
"matchCriteriaId": "0BD63969-D18D-41AF-9814-DA1A207BDE80",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.0.95:*:*:*:*:*:*:*",
"matchCriteriaId": "7EAD8958-173A-4FCC-9420-A148BA5F73E2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.0.96:*:*:*:*:*:*:*",
"matchCriteriaId": "B271F6AD-D829-4671-8FA7-7D921364B426",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.0.97:*:*:*:*:*:*:*",
"matchCriteriaId": "C25E03A8-46B5-4AC7-8506-4C255D7CC400",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.0.98:*:*:*:*:*:*:*",
"matchCriteriaId": "2C76CD53-CC9F-491A-952F-9A82D6E20058",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.0.99:*:*:*:*:*:*:*",
"matchCriteriaId": "E749D64E-5C47-4A34-9F3C-1D34F8348058",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EE0C9CBB-D52F-4F7C-B343-E685A3996BC6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "CB90A3FB-B107-46CF-A846-48EE0EDF637A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "088BFFA4-1AAB-4699-9793-F731A81B296A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B3475779-383A-4128-9145-474EC08030FE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.2.2p1:*:*:*:*:*:*:*",
"matchCriteriaId": "782BAA3D-A639-4B25-83F0-741074C88D7F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.2.2p2:*:*:*:*:*:*:*",
"matchCriteriaId": "EF367FA4-2C7F-4040-89DE-8A97A069A802",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.2.2p3:*:*:*:*:*:*:*",
"matchCriteriaId": "01D11498-3FC4-4890-9B10-BBA74A01C9E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.2.2p4:*:*:*:*:*:*:*",
"matchCriteriaId": "9D085796-5574-4EF3-8CD4-3CCEF2867823",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "5E0D2303-95BD-4260-86FC-3DFED8532092",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.2.4p0:*:*:*:*:*:*:*",
"matchCriteriaId": "AA843BCD-372A-42F5-A8C0-1AD32FA9E94C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.2.4p1:*:*:*:*:*:*:*",
"matchCriteriaId": "B980A178-2958-4B36-8AD8-3932B12C5A72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.2.4p2:*:*:*:*:*:*:*",
"matchCriteriaId": "5D65210A-F80E-4019-91DA-49838369E03F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.2.4p3:*:*:*:*:*:*:*",
"matchCriteriaId": "29FAB224-3493-4273-A655-10BE44F5B5BE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.2.4p4:*:*:*:*:*:*:*",
"matchCriteriaId": "093F0DD2-9E88-4138-AFF5-69105E7F2C92",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.2.4p5:*:*:*:*:*:*:*",
"matchCriteriaId": "B3590927-E242-411D-822A-33337D6B8A4B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.2.4p6:*:*:*:*:*:*:*",
"matchCriteriaId": "20FCD55C-D4A8-4544-81AF-C920B3B48A2F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Stack-based buffer overflow in the cookedprint function in ntpq/ntpq.c in ntpq in NTP before 4.2.4p7-RC2 allows remote NTP servers to execute arbitrary code via a crafted response."
},
{
"lang": "es",
"value": "Desbordamiento de b\u00fafer basado en pila en la funci\u00f3n cookedprint en ntpq/ntpq.c en ntpq en NTP versiones anteriores a v4.2.4p7-RC2 permite a servidores NTP remotos ejecutar c\u00f3digo de su elecci\u00f3n a trav\u00e9s de respuestas manipuladas."
}
],
"id": "CVE-2009-0159",
"lastModified": "2025-04-09T00:30:58.490",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2009-04-14T15:30:00.517",
"references": [
{
"source": "cve@mitre.org",
"url": "ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-006.txt.asc"
},
{
"source": "cve@mitre.org",
"url": "http://bugs.pardus.org.tr/show_bug.cgi?id=9532"
},
{
"source": "cve@mitre.org",
"url": "http://lists.apple.com/archives/security-announce/2009/May/msg00002.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html"
},
{
"source": "cve@mitre.org",
"url": "http://marc.info/?l=bugtraq\u0026m=136482797910018\u0026w=2"
},
{
"source": "cve@mitre.org",
"url": "http://marc.info/?l=bugtraq\u0026m=136482797910018\u0026w=2"
},
{
"source": "cve@mitre.org",
"url": "http://ntp.bkbits.net:8080/ntp-stable/?PAGE=gnupatch\u0026REV=1.1565"
},
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/53593"
},
{
"source": "cve@mitre.org",
"url": "http://rhn.redhat.com/errata/RHSA-2009-1039.html"
},
{
"source": "cve@mitre.org",
"url": "http://rhn.redhat.com/errata/RHSA-2009-1040.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/34608"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/35074"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/35137"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/35138"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/35166"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/35169"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/35253"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/35308"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/35336"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/35416"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/35630"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/37471"
},
{
"source": "cve@mitre.org",
"url": "http://slackware.com/security/viewer.php?l=slackware-security\u0026y=2009\u0026m=slackware-security.566238"
},
{
"source": "cve@mitre.org",
"url": "http://support.apple.com/kb/HT3549"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2009/dsa-1801"
},
{
"source": "cve@mitre.org",
"url": "http://www.gentoo.org/security/en/glsa/glsa-200905-08.xml"
},
{
"source": "cve@mitre.org",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:092"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/507985/100/0/threaded"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/34481"
},
{
"source": "cve@mitre.org",
"url": "http://www.securitytracker.com/id?1022033"
},
{
"source": "cve@mitre.org",
"tags": [
"US Government Resource"
],
"url": "http://www.us-cert.gov/cas/techalerts/TA09-133A.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.vmware.com/security/advisories/VMSA-2009-0016.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2009/0999"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2009/1297"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2009/3316"
},
{
"source": "cve@mitre.org",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=490617"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/49838"
},
{
"source": "cve@mitre.org",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19392"
},
{
"source": "cve@mitre.org",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5411"
},
{
"source": "cve@mitre.org",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8386"
},
{
"source": "cve@mitre.org",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8665"
},
{
"source": "cve@mitre.org",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9634"
},
{
"source": "cve@mitre.org",
"url": "https://rhn.redhat.com/errata/RHSA-2009-1651.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://support.ntp.org/bugs/show_bug.cgi?id=1144"
},
{
"source": "cve@mitre.org",
"url": "https://usn.ubuntu.com/777-1/"
},
{
"source": "cve@mitre.org",
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01414.html"
},
{
"source": "cve@mitre.org",
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01449.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-006.txt.asc"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://bugs.pardus.org.tr/show_bug.cgi?id=9532"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.apple.com/archives/security-announce/2009/May/msg00002.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://marc.info/?l=bugtraq\u0026m=136482797910018\u0026w=2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://marc.info/?l=bugtraq\u0026m=136482797910018\u0026w=2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://ntp.bkbits.net:8080/ntp-stable/?PAGE=gnupatch\u0026REV=1.1565"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/53593"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://rhn.redhat.com/errata/RHSA-2009-1039.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://rhn.redhat.com/errata/RHSA-2009-1040.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/34608"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/35074"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/35137"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/35138"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/35166"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/35169"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/35253"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/35308"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/35336"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/35416"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/35630"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/37471"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://slackware.com/security/viewer.php?l=slackware-security\u0026y=2009\u0026m=slackware-security.566238"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://support.apple.com/kb/HT3549"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2009/dsa-1801"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.gentoo.org/security/en/glsa/glsa-200905-08.xml"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:092"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/507985/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/34481"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securitytracker.com/id?1022033"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"US Government Resource"
],
"url": "http://www.us-cert.gov/cas/techalerts/TA09-133A.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vmware.com/security/advisories/VMSA-2009-0016.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2009/0999"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2009/1297"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2009/3316"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=490617"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/49838"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19392"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5411"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8386"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8665"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9634"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://rhn.redhat.com/errata/RHSA-2009-1651.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://support.ntp.org/bugs/show_bug.cgi?id=1144"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://usn.ubuntu.com/777-1/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01414.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01449.html"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-119"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
ghsa-wg77-pm57-j6rv
Vulnerability from github
Published
2022-05-03 03:20
Modified
2022-05-03 03:20
VLAI Severity ?
Details
Stack-based buffer overflow in the cookedprint function in ntpq/ntpq.c in ntpq in NTP before 4.2.4p7-RC2 allows remote NTP servers to execute arbitrary code via a crafted response.
{
"affected": [],
"aliases": [
"CVE-2009-0159"
],
"database_specific": {
"cwe_ids": [
"CWE-119"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2009-04-14T15:30:00Z",
"severity": "MODERATE"
},
"details": "Stack-based buffer overflow in the cookedprint function in ntpq/ntpq.c in ntpq in NTP before 4.2.4p7-RC2 allows remote NTP servers to execute arbitrary code via a crafted response.",
"id": "GHSA-wg77-pm57-j6rv",
"modified": "2022-05-03T03:20:22Z",
"published": "2022-05-03T03:20:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2009-0159"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=490617"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/49838"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19392"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5411"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8386"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8665"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9634"
},
{
"type": "WEB",
"url": "https://rhn.redhat.com/errata/RHSA-2009-1651.html"
},
{
"type": "WEB",
"url": "https://support.ntp.org/bugs/show_bug.cgi?id=1144"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/777-1"
},
{
"type": "WEB",
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01414.html"
},
{
"type": "WEB",
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01449.html"
},
{
"type": "WEB",
"url": "http://bugs.pardus.org.tr/show_bug.cgi?id=9532"
},
{
"type": "WEB",
"url": "http://lists.apple.com/archives/security-announce/2009/May/msg00002.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html"
},
{
"type": "WEB",
"url": "http://marc.info/?l=bugtraq\u0026m=136482797910018\u0026w=2"
},
{
"type": "WEB",
"url": "http://ntp.bkbits.net:8080/ntp-stable/?PAGE=gnupatch\u0026REV=1.1565"
},
{
"type": "WEB",
"url": "http://osvdb.org/53593"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2009-1039.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2009-1040.html"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/34608"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/35074"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/35137"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/35138"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/35166"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/35169"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/35253"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/35308"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/35336"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/35416"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/35630"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/37471"
},
{
"type": "WEB",
"url": "http://slackware.com/security/viewer.php?l=slackware-security\u0026y=2009\u0026m=slackware-security.566238"
},
{
"type": "WEB",
"url": "http://support.apple.com/kb/HT3549"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2009/dsa-1801"
},
{
"type": "WEB",
"url": "http://www.gentoo.org/security/en/glsa/glsa-200905-08.xml"
},
{
"type": "WEB",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:092"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/507985/100/0/threaded"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/34481"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id?1022033"
},
{
"type": "WEB",
"url": "http://www.us-cert.gov/cas/techalerts/TA09-133A.html"
},
{
"type": "WEB",
"url": "http://www.vmware.com/security/advisories/VMSA-2009-0016.html"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2009/0999"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2009/1297"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2009/3316"
}
],
"schema_version": "1.4.0",
"severity": []
}
gsd-2009-0159
Vulnerability from gsd
Modified
2023-12-13 01:19
Details
Stack-based buffer overflow in the cookedprint function in ntpq/ntpq.c in ntpq in NTP before 4.2.4p7-RC2 allows remote NTP servers to execute arbitrary code via a crafted response.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2009-0159",
"description": "Stack-based buffer overflow in the cookedprint function in ntpq/ntpq.c in ntpq in NTP before 4.2.4p7-RC2 allows remote NTP servers to execute arbitrary code via a crafted response.",
"id": "GSD-2009-0159",
"references": [
"https://www.suse.com/security/cve/CVE-2009-0159.html",
"https://www.debian.org/security/2009/dsa-1801",
"https://access.redhat.com/errata/RHSA-2009:1651",
"https://access.redhat.com/errata/RHSA-2009:1040",
"https://access.redhat.com/errata/RHSA-2009:1039",
"https://linux.oracle.com/cve/CVE-2009-0159.html"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2009-0159"
],
"details": "Stack-based buffer overflow in the cookedprint function in ntpq/ntpq.c in ntpq in NTP before 4.2.4p7-RC2 allows remote NTP servers to execute arbitrary code via a crafted response.",
"id": "GSD-2009-0159",
"modified": "2023-12-13T01:19:43.661707Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2009-0159",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Stack-based buffer overflow in the cookedprint function in ntpq/ntpq.c in ntpq in NTP before 4.2.4p7-RC2 allows remote NTP servers to execute arbitrary code via a crafted response."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "USN-777-1",
"refsource": "UBUNTU",
"url": "https://usn.ubuntu.com/777-1/"
},
{
"name": "oval:org.mitre.oval:def:9634",
"refsource": "OVAL",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9634"
},
{
"name": "35137",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/35137"
},
{
"name": "34608",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/34608"
},
{
"name": "35166",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/35166"
},
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=490617",
"refsource": "CONFIRM",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=490617"
},
{
"name": "http://support.apple.com/kb/HT3549",
"refsource": "CONFIRM",
"url": "http://support.apple.com/kb/HT3549"
},
{
"name": "37471",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/37471"
},
{
"name": "DSA-1801",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2009/dsa-1801"
},
{
"name": "FEDORA-2009-5275",
"refsource": "FEDORA",
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01449.html"
},
{
"name": "35308",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/35308"
},
{
"name": "http://bugs.pardus.org.tr/show_bug.cgi?id=9532",
"refsource": "CONFIRM",
"url": "http://bugs.pardus.org.tr/show_bug.cgi?id=9532"
},
{
"name": "35253",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/35253"
},
{
"name": "http://www.vmware.com/security/advisories/VMSA-2009-0016.html",
"refsource": "CONFIRM",
"url": "http://www.vmware.com/security/advisories/VMSA-2009-0016.html"
},
{
"name": "35074",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/35074"
},
{
"name": "34481",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/34481"
},
{
"name": "35138",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/35138"
},
{
"name": "APPLE-SA-2009-05-12",
"refsource": "APPLE",
"url": "http://lists.apple.com/archives/security-announce/2009/May/msg00002.html"
},
{
"name": "oval:org.mitre.oval:def:8386",
"refsource": "OVAL",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8386"
},
{
"name": "SSA:2009-154-01",
"refsource": "SLACKWARE",
"url": "http://slackware.com/security/viewer.php?l=slackware-security\u0026y=2009\u0026m=slackware-security.566238"
},
{
"name": "SSRT101144",
"refsource": "HP",
"url": "http://marc.info/?l=bugtraq\u0026m=136482797910018\u0026w=2"
},
{
"name": "FEDORA-2009-5273",
"refsource": "FEDORA",
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01414.html"
},
{
"name": "SUSE-SR:2009:011",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html"
},
{
"name": "oval:org.mitre.oval:def:19392",
"refsource": "OVAL",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19392"
},
{
"name": "35630",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/35630"
},
{
"name": "20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/507985/100/0/threaded"
},
{
"name": "ntp-cookedprint-bo(49838)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/49838"
},
{
"name": "53593",
"refsource": "OSVDB",
"url": "http://osvdb.org/53593"
},
{
"name": "1022033",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id?1022033"
},
{
"name": "oval:org.mitre.oval:def:8665",
"refsource": "OVAL",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8665"
},
{
"name": "TA09-133A",
"refsource": "CERT",
"url": "http://www.us-cert.gov/cas/techalerts/TA09-133A.html"
},
{
"name": "RHSA-2009:1651",
"refsource": "REDHAT",
"url": "https://rhn.redhat.com/errata/RHSA-2009-1651.html"
},
{
"name": "ADV-2009-1297",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2009/1297"
},
{
"name": "oval:org.mitre.oval:def:5411",
"refsource": "OVAL",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5411"
},
{
"name": "RHSA-2009:1040",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2009-1040.html"
},
{
"name": "MDVSA-2009:092",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:092"
},
{
"name": "35416",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/35416"
},
{
"name": "https://support.ntp.org/bugs/show_bug.cgi?id=1144",
"refsource": "CONFIRM",
"url": "https://support.ntp.org/bugs/show_bug.cgi?id=1144"
},
{
"name": "HPSBUX02859",
"refsource": "HP",
"url": "http://marc.info/?l=bugtraq\u0026m=136482797910018\u0026w=2"
},
{
"name": "35336",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/35336"
},
{
"name": "NetBSD-SA2009-006",
"refsource": "NETBSD",
"url": "ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-006.txt.asc"
},
{
"name": "RHSA-2009:1039",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2009-1039.html"
},
{
"name": "35169",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/35169"
},
{
"name": "GLSA-200905-08",
"refsource": "GENTOO",
"url": "http://www.gentoo.org/security/en/glsa/glsa-200905-08.xml"
},
{
"name": "ADV-2009-0999",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2009/0999"
},
{
"name": "ADV-2009-3316",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2009/3316"
},
{
"name": "http://ntp.bkbits.net:8080/ntp-stable/?PAGE=gnupatch\u0026REV=1.1565",
"refsource": "CONFIRM",
"url": "http://ntp.bkbits.net:8080/ntp-stable/?PAGE=gnupatch\u0026REV=1.1565"
}
]
}
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.2.4p4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.2.4p6:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.2.4p0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.0.72:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.0.73:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.0.97:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.0.98:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.2.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.2.4p5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.2.2p4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.1.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.0.95:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.0.96:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.2.4p3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.2.4p2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.2.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.2.2p1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.0.90:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.0.91:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.0.99:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.1.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.2.4p1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.2.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.2.2p2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.2.2p3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.0.92:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.0.93:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.0.94:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:*:rc1:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "4.2.4p7",
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2009-0159"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "Stack-based buffer overflow in the cookedprint function in ntpq/ntpq.c in ntpq in NTP before 4.2.4p7-RC2 allows remote NTP servers to execute arbitrary code via a crafted response."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-119"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://bugs.pardus.org.tr/show_bug.cgi?id=9532",
"refsource": "CONFIRM",
"tags": [],
"url": "http://bugs.pardus.org.tr/show_bug.cgi?id=9532"
},
{
"name": "34608",
"refsource": "SECUNIA",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/34608"
},
{
"name": "https://support.ntp.org/bugs/show_bug.cgi?id=1144",
"refsource": "CONFIRM",
"tags": [
"Patch"
],
"url": "https://support.ntp.org/bugs/show_bug.cgi?id=1144"
},
{
"name": "34481",
"refsource": "BID",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/34481"
},
{
"name": "53593",
"refsource": "OSVDB",
"tags": [],
"url": "http://osvdb.org/53593"
},
{
"name": "1022033",
"refsource": "SECTRACK",
"tags": [],
"url": "http://www.securitytracker.com/id?1022033"
},
{
"name": "ADV-2009-0999",
"refsource": "VUPEN",
"tags": [
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2009/0999"
},
{
"name": "MDVSA-2009:092",
"refsource": "MANDRIVA",
"tags": [],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:092"
},
{
"name": "TA09-133A",
"refsource": "CERT",
"tags": [
"US Government Resource"
],
"url": "http://www.us-cert.gov/cas/techalerts/TA09-133A.html"
},
{
"name": "ADV-2009-1297",
"refsource": "VUPEN",
"tags": [
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2009/1297"
},
{
"name": "http://support.apple.com/kb/HT3549",
"refsource": "CONFIRM",
"tags": [],
"url": "http://support.apple.com/kb/HT3549"
},
{
"name": "35074",
"refsource": "SECUNIA",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/35074"
},
{
"name": "APPLE-SA-2009-05-12",
"refsource": "APPLE",
"tags": [],
"url": "http://lists.apple.com/archives/security-announce/2009/May/msg00002.html"
},
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=490617",
"refsource": "CONFIRM",
"tags": [],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=490617"
},
{
"name": "http://ntp.bkbits.net:8080/ntp-stable/?PAGE=gnupatch\u0026REV=1.1565",
"refsource": "CONFIRM",
"tags": [],
"url": "http://ntp.bkbits.net:8080/ntp-stable/?PAGE=gnupatch\u0026REV=1.1565"
},
{
"name": "RHSA-2009:1040",
"refsource": "REDHAT",
"tags": [],
"url": "http://rhn.redhat.com/errata/RHSA-2009-1040.html"
},
{
"name": "RHSA-2009:1039",
"refsource": "REDHAT",
"tags": [],
"url": "http://rhn.redhat.com/errata/RHSA-2009-1039.html"
},
{
"name": "35137",
"refsource": "SECUNIA",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/35137"
},
{
"name": "DSA-1801",
"refsource": "DEBIAN",
"tags": [],
"url": "http://www.debian.org/security/2009/dsa-1801"
},
{
"name": "35169",
"refsource": "SECUNIA",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/35169"
},
{
"name": "35166",
"refsource": "SECUNIA",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/35166"
},
{
"name": "FEDORA-2009-5275",
"refsource": "FEDORA",
"tags": [],
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01449.html"
},
{
"name": "35138",
"refsource": "SECUNIA",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/35138"
},
{
"name": "FEDORA-2009-5273",
"refsource": "FEDORA",
"tags": [],
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01414.html"
},
{
"name": "GLSA-200905-08",
"refsource": "GENTOO",
"tags": [],
"url": "http://www.gentoo.org/security/en/glsa/glsa-200905-08.xml"
},
{
"name": "35253",
"refsource": "SECUNIA",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/35253"
},
{
"name": "35308",
"refsource": "SECUNIA",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/35308"
},
{
"name": "35336",
"refsource": "SECUNIA",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/35336"
},
{
"name": "SSA:2009-154-01",
"refsource": "SLACKWARE",
"tags": [],
"url": "http://slackware.com/security/viewer.php?l=slackware-security\u0026y=2009\u0026m=slackware-security.566238"
},
{
"name": "SUSE-SR:2009:011",
"refsource": "SUSE",
"tags": [],
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html"
},
{
"name": "35416",
"refsource": "SECUNIA",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/35416"
},
{
"name": "35630",
"refsource": "SECUNIA",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/35630"
},
{
"name": "NetBSD-SA2009-006",
"refsource": "NETBSD",
"tags": [],
"url": "ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-006.txt.asc"
},
{
"name": "37471",
"refsource": "SECUNIA",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/37471"
},
{
"name": "RHSA-2009:1651",
"refsource": "REDHAT",
"tags": [],
"url": "https://rhn.redhat.com/errata/RHSA-2009-1651.html"
},
{
"name": "ADV-2009-3316",
"refsource": "VUPEN",
"tags": [
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2009/3316"
},
{
"name": "http://www.vmware.com/security/advisories/VMSA-2009-0016.html",
"refsource": "CONFIRM",
"tags": [],
"url": "http://www.vmware.com/security/advisories/VMSA-2009-0016.html"
},
{
"name": "SSRT101144",
"refsource": "HP",
"tags": [],
"url": "http://marc.info/?l=bugtraq\u0026m=136482797910018\u0026w=2"
},
{
"name": "ntp-cookedprint-bo(49838)",
"refsource": "XF",
"tags": [],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/49838"
},
{
"name": "oval:org.mitre.oval:def:9634",
"refsource": "OVAL",
"tags": [],
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9634"
},
{
"name": "oval:org.mitre.oval:def:8665",
"refsource": "OVAL",
"tags": [],
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8665"
},
{
"name": "oval:org.mitre.oval:def:8386",
"refsource": "OVAL",
"tags": [],
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8386"
},
{
"name": "oval:org.mitre.oval:def:5411",
"refsource": "OVAL",
"tags": [],
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5411"
},
{
"name": "oval:org.mitre.oval:def:19392",
"refsource": "OVAL",
"tags": [],
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19392"
},
{
"name": "USN-777-1",
"refsource": "UBUNTU",
"tags": [],
"url": "https://usn.ubuntu.com/777-1/"
},
{
"name": "20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components",
"refsource": "BUGTRAQ",
"tags": [],
"url": "http://www.securityfocus.com/archive/1/507985/100/0/threaded"
}
]
}
},
"impact": {
"baseMetricV2": {
"cvssV2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"userInteractionRequired": true
}
},
"lastModifiedDate": "2018-10-11T21:00Z",
"publishedDate": "2009-04-14T15:30Z"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…